This episode was prerecorded as part of a live continuing education webinar. On-demand CEUs are still available for this presentation through all CEUs. Register at allceus.com slash counselor toolbox. I'd like to welcome everybody to today's presentation on confidentiality, HIPAA, and high tech. Now we're going to talk throughout this presentation in terms of both face-to-face and, you know, old-fashioned counseling where we've got paper charts because I know some people still, especially people in private practice, still have paper charts. And we're also going to talk about how it applies to e-therapy and electronic health records. So we're going to review HIPAA and high-tech regulations as they pertain to maintaining confidentiality and security of protected health information. Now that part is a little bit boring, you know, legalese is legalese. I'm going to try to make it as applicable to you as possible. In two hours, in one hour especially, but in two hours I can't begin to go over in-depth everything in HIPAA and high-tech. So one of the things that you will notice is that I'm kind of hitting the highlights. If you haven't had a HIPAA class or if you think you need more information about HIPAA, we will have an on-demand class that has the whole HIPAA text in it and everything. But for most people you're probably taking this for ethics and or for your HIPAA retraining requirement. Please feel free again to ask any questions in the webinar chat room and I will answer them to the best of my ability as we go through. I want to encourage you to critically assess your work practices for compliance. And, you know, you'll hear some things that I'll say and I'll give you some examples of places I've worked or things that I have heard about in other places where people work that are HIPAA violations. And we'll talk about whether it is, you know, how big of a deal it is and as we go through. And my third goal is just to help keep you awake throughout the presentation because I know some of this, you know, laws and rules and all that kind of stuff can get a little monotonous. So let's start out with business associates because when we talk about HIPAA and high tech, it's important to understand that there's a person or entity that performs certain functions or activities that involve the use or disclosure of PHI on behalf of or provide services to a covered entity. So basically anybody that has access to your PHI is potentially a business associate. Now, they've upped the requirement with high tech and they've said anybody who is a business associate is not just suggested to meet HIPAA requirements, but they are held to the same standard as HIPAA. And it's going to be really important that you get a business associate agreement signed with them. So business associate functions and activities, billing, claims processing, administration, benefit management. So if you use a billing company, which I know a lot of us do, it's important that you actually have a signed business associate agreement with them. Anybody who does data analysis, processing or administration, if they have access to your PHI, you'll need a business associate agreement. And utilization review and quality assurance, you know, and we're going to talk about some exceptions to this. But if you have an outside entity coming in to do utilization review and QA, you will need a business associate agreement. One thing they have determined is internet service providers. So whoever it is you get your internet from whether it's Comcast or AT&T or whatever they're called, wherever you are. They are not business associates because the information doesn't stop along the way. It just kind of goes through their channels. They make the analogy of the post office is not a business associate back when we used to mail things back and forth. So, you know, that's one thing you don't need to worry about. But software vendors providing electronic health record systems and providers of virtual offices and your email services. And this is a biggie. Gmail is not HIPAA compliant. All of these clearly qualify as business associates. If the information lands in a place like the electronic health record, the virtual office or in your email, then it's important to understand that the business associate rule applies. So, you know, a lot of agencies use very, very unsecure emails. So, you know, if you work in an agency and you've got a tech department, they're probably handling that and keeping it encrypted and all that kind of stuff. If you're using Gmail, know that that is not HIPAA compliant. Even though they say Gmail is encrypted, you have to have a business associate agreement with them and Gmail is not going to sign one. And there are some other technical hurdles that help you understand that they are not HIPAA compliant. Risk analysis is required of the potential risks and vulnerabilities to the confidentiality, integrity and availability of protected health information. Now, the ones I have in blue are things that I have seen experienced and I think are regularly not followed. We'll just say that. And when it says required, that actually, it's actually stated as required in the statute. So, not only, you know, even if you're an individual practitioner, you have to have documentation that you completed a risk analysis of potential risks, vulnerabilities to the confidentiality and integrity of your information and the availability. You need to know that when you need the information, you can get to it and we're going to talk about disaster planning at some point during the day-to-day. But HIPAA does require that you back up and store information in a secure location that you can access in the event of some sort of electronic failure or natural disaster or something like that. So, HIPAA, if you remember, is the Health Care Information Portability and Accessibility Act. So, HIPAA does not just protect confidentiality, but it also makes sure or requires that we make sure the data and client files are available. So, even if you're in a small practice, I mean, obviously it's easier to do the risk analysis here, but you do need to do one and have it documented. If there is ever a breach, they're going to look for your risk analysis documentation. Risk management is also required. So, you have to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with the statute. Now, reasonable and appropriate is what we want to focus on here. It doesn't need to be Fort Knox. If you remember, back in the olden days, we used to talk about it had to be behind two locked doors. So, if you're using old-fashioned paper records, you know, that's one of those things that you can consider is, you know, if somebody walked into your office, are the client records sitting on your desk? That is not HIPAA compliant. If you get up and, you know, walk away from your desk, then somebody can access those charts. I see this violated a lot. So, it's really important to pay attention to what the security measures are. If you do have paper charts, how do you store those when you leave your desk? Do you store them in a locked filing cabinet, which is, you know, the ideal solution? If you have electronic health records, if you get up again and go to the bathroom, get a cup of coffee, whatever you're doing, can somebody sit down at your desk and access that information? Generally, you want to have security measures in place, like a timeout. So, if there's been zero activity on your computer for a minute and a half, it will automatically lock. But you should also be in the habit of locking your screen when you get up and walk away from your computer. Even if you don't have an electronic health record, if you just type your progress notes or something on the computer, it's important to make sure that somebody can't access it. And you have to have a sanction policy. If there's, you know, anybody else in your office or if you are working for an agency, they need to have a sanction policy. If people fail to comply with the security policies. For example, they download client information because they still need to do, they got backed up and they need to do like three weeks worth of notes, which in and of itself is an ethical issue, but never mind.  And they take it out of the facility, take it home and plug it into their non-encrypted hard drive on their computer to type up the information. So many violations there on so many different levels. So, if they found out that someone was doing that, there would have to be some sort of a sanction for it. Now, people need to know ahead of time what the rules are, but you also need to use obviously good common sense. Information system activity review is required. So someone, if you're using an electronic health record or if you're just using your own computer, you need to regularly kind of audit who's been trying to access your network, who's been on your network, and if anybody's had access or tried to access anything. Now, at this point, I'll give my little spiel that if you're using any kind of computer, not just a laptop, the entire hard drive needs to be encrypted, not just the folders that you're working on because when you print, it goes to a whole different folder and it gets saved in a print, what's called a print spool. So you can theoretically have PHI on your hard drive or laptop that is not encrypted, even if you had an encrypted file. So have your whole hard drive encrypted.  You don't have to worry about that. You also want to have the ability to wipe your computer from virtually. So if you do lose your laptop, you can log in and wipe all the data that's on there from a remote location just to prevent anybody from hacking the encryption. Let's see. You want to ensure that all members of the workforce have appropriate access to the electronic health information or just health information, protected health information, and prevent those who don't from obtaining access to protected health information, electronic or not. Another example where I used to work, we had paper charts. You know, I've been doing this for about 20 years now. So, you know, we're going back past paper chart back to paper charts. And unfortunately, I am not able to handle technical questions in the middle of the webinar. So I will get to any technical questions afterwards. The PHI that you have stored, you need to make sure that the janitors can't get to it, or if they do, they've been trained and had all the background clearing and everything. But generally, you want to have policies in place where if janitorial staff is going somewhere where protected health information is in an unsecured setting, like in racks and racks and racks of files. That there is someone there to monitor the situation. Worst case scenario, have some sort of video monitoring so you can make sure that you are not having your PHI breached. You can regularly audit those videotapes to make sure they're not going in and looking at it. Most janitorial staff really doesn't care, but it's one of those things that HIPAA wants you to set up. Also making sure that your front desk staff doesn't have access to all of the information. You know, we really don't want people being able to grab an entire chart and have it at the front desk. Yes, they need the demographic data for billing. The front desk needs certain data to check people in. But we need to figure out a way that they can have access to that without having access to progress notes, medical notes, et cetera. So that's one of the things that HIPAA puts forth is that we need to do our best to make sure that people who have no business reading progress notes don't have access to progress notes, whether it's electronic or paper. Now electronic, it's a lot easier because you can control access to certain areas in a electronic health system. Paper, it's a little bit harder. You need to implement procedures for the authorization and or supervision of workforce members who work with protected health information or in locations where it might be accessed. So if you have a one of the places I worked used to have sort of a kiosk where all the clinicians could go log in, go to their, their clients files and access the data they needed print from their whatever. We also had a place that I used to work that they would you only we only had one printer. So it was important to kind of be able to know what was going on. Unfortunately, in this particular situation, the printer was not in a secured location. So it was behind the front desk and all clinicians had to send everything they wanted to print to this printer at the front desk and you can see where there's all kinds of protected health information violation possibilities coming out. You could have a one clinician get somebody else's progress notes, you could have front desk staff get hold of progress notes that they're not supposed to access all kinds of stuff. So it is really important if you're having printing stuff out to make sure that you know that that is secure. Same thing with faxing, you don't want to just randomly fax information to a unsecured fax machine you want to make sure whoever's the intended recipient is there and able to access it. There's only so much you can do in order to verify that but you do want to have that as a policy. Implement procedures to determine that access of a workforce member to the protected health information is appropriate. Like I said, janitorial staff front desk staff billing staff. You know, they all have different levels of need from no need to some need to access the chart but they don't need all of the clinical information. And you need to implement procedures for terminating access to protected health information when the employment or other arrangement with the workforce member ends or changes.  So most agencies are really good at this. It's monitoring who has access to the information among the people that are currently employed with the agency. It's important to implement written policies and procedures for authorizing access to PHI. If again there's a breach and most of the time this isn't going to come up but if there is a breach they're going to want to say what were your policies for ensuring that such and so person didn't have access to this information. One of, you know, my experience has been we had multiple instances in a facility that I worked at where we would have family members of staff people. It was a very, very, very large agency, but we would have family members of staff people come through our treatment center. And obviously that family member is not going to be entitled to access to that client record. So it was important to make sure that we had a process if there was highly sensitive information to also guard against people having access to it. Implement policies and procedures that establish document review and modify a user's right of access to a workstation transaction program or process. So if you have virtual workstations, how do people log on? You don't want to have everybody logging on using the same username and password. Really bad mojo because that gives somebody access to stuff they don't need. You want to make sure you have key cards or keys to get into offices and places where protected health information is stored. And it's important to also use secure passwords. You don't want to use something like, you know, forgot or some common word. You want to make sure you have a secure password that has capital, lowercase and numbers and or special characters in it, which can be a challenge to use one trick that I was taught was I have a standard kind of password that I use on some things, not on my PHI. But, you know, if you pick a password for your PHI, then change it periodically by changing it. The numbers associated with it, either using a particular date like the year or the month that you changed it. So it's easier to remember when you have to update your password. Most places prompt you to update your password every six months. Management, not only line staff, but management as well as anybody who would have access to PHI needs to have training for HIPAA and high tech security. They need to have access to periodic security updates. Now it doesn't have to be a formal training, maybe sending out a memo that everybody has to sign off on or, you know, however your agency wants to do it. But if you change electronic health records, if there's a security update that people need to know about a change in policy, it's important to send that out. You need to have procedures for guarding against detecting and reporting malicious software. So again, if you're using your personal computer to do clinical work, you know, you have a totally encrypted hard drive. That's wonderful. But you also need to have lots of protection against malware if that computer connects to the internet at all. You want to have procedures for monitoring login attempts and reporting discrepancies. So if somebody tries to log into your workstation, you know, they log in three times. It locks them out for 30 minutes or until somebody else like your IT department comes and unlocks it for them. And there needs to be procedures for creating, changing and safeguarding passwords. Tell people and make sure they know it and they can be disciplined for it. Don't write your password and put it in your desk drawer.  No, that's the first place people are going to look. If you have a password, there are things like we use a program called LastPass, but there are a lot of password storage programs out there if you want to store your password somewhere that are like mega, mega encrypted. So you don't have to remember every permutation of the password you're using, but you do need to have a process for safeguarding your passwords. And again, even if you're using your own personal computer and it's fully encrypted, you want to change that password every six months in order to prevent any sort of problems. Establish and implement as needed policies and procedures for responding to a disaster that damages system that contain electronic PHI. And this is also true about paper PHI, but, you know, most of the time we don't have a backup copy of the paper records. So, you know, that's one of the reasons that EPHI is somewhat preferable. But there has to be a written data backup plan. So where are you backing it up? How's it encrypted? Where's it stored? How do you recover it? You know, if you have a complete system failure and your server just fries, and it happens, it's important that you have a backup of all the client data somewhere that you can access. Ideally, and you can set it up so it happens automatically, that you've got backups that are occurring very, very frequently. If you're in a private practice, it's not as big of a deal to have it done like every five or 10 minutes. But you can get it as frequently as real-time backup. So anytime anything changes, the system runs a backup and stores it somewhere off-site. So if there is a natural disaster or, you know, a power fluctuation or something happens, you do have a copy of that data. That's required. The disaster recovery plan has to include procedures, and a lot of us who are in private practice haven't done this. It has to include procedures to enable continuation of critical business processes and for the protection and security of EPHI while operating in emergency mode. So again, it's important that, you know, even if your server fries, you can access the information on that backup server for all the clients that you've got today while your IT department is getting you set up again. It's also important that, you know, if there's a natural disaster and I spent many, many, many years in Florida and we would have hurricanes and there are places, tornadoes, whatever. If you are for some reason, you know, can't go back to your facility, it's important to be able to access that information from a remote location where you are continuing to provide clinical services. So if you're going to the shelters to meet with your clients or if you have a temporary shelter set up, and we'll talk about this in two classes when we talk about disaster recovery. Your agency should have a plan in place, so if your building was completely wiped out, you would have somewhere where you could go and restart treatment relatively quickly in order to not disrupt continuity of care or the ability to refer to designated clinicians and the ability for them to access the PHI, which obviously they wouldn't have access to unless there was an emergency. But there has to be a disaster recovery plan to maintain continuity of care. It is recommended, not required, to implement policies and procedures for periodic testing and revision of these contingency plans. If you're a small practice, probably not going to be something you have to regularly test. If you are a community mental health agency with 100 clinicians, your IT departments probably periodically testing and making sure that, you know, if the stuff hits the fan, they can actually recoup all of the data. You can implement physical access to electronic information systems and the facility or facilities in which they're housed.  Can somebody just go up to a computer and start working on it? Places I've worked before. I'm not saying there are times when you're going to get up and have to go to the bathroom or get something off a printer or something and leave a client unattended, if you will, in the office. But you don't want them to be able to access any of the PHI written or electronic. So your computer needs to be locked and encrypted and your paper files, anything you have written the old fashioned way needs to be in a locked file drawer. People with home offices, and I see a lot more breaches here where people with home offices have their client information stored, you know, in a file that is maybe encrypted, but they're using a profile that everybody else in the family uses. Or they have information on their computer and they don't have all the security measures. So they may be working on a progress note, get up, go to make supper, somebody else sits down at the computer, opens it up, and Jim Bob's progress note pops up and everybody in the family potentially could see it. The other place where this comes up is if you're working in a home office and people, you know, your families, whatever, are walking around behind you and you're doing a video chat with somebody or even if you're doing just a chat chat or typing notes, and people can walk up behind you, start reading what you're typing. It's really important to make sure that wherever you're providing the services, wherever there is protected health information, only you can access it or and or people that are, you know, determine that they need to have access to it. You also don't want to work on your laptop that has PHI on it on unsecured Wi-Fi, such as, you know, I'm just going to work on my progress notes while I sit at Starbucks or McDonald's or something and use their Wi-Fi potential for being hacked there. It's slim, but it is not good practice to be on Wi-Fi. Now if you go in there and you don't connect to the Wi-Fi and you're just working on your laptop typing or progress notes, you know, you don't have a chance of having a problem there. But there are a lot of unsecured Wi-Fi hot points that have malware on them that will infect your computer. If you have workstations that multiple people use, it needs to be clear what functions can be performed at that workstation and who has access to what. The physical attributes of the surroundings of a specific workstation also needs to be considered. So again, think about going to the doctor and this is one of my big pet peeves.  And you can see everybody who has an appointment that day or you can see charts, you know, maybe she was working on somebody else's chart when you walked up and you can see clearly what she was working on. Now, you know, obviously, if we're clinicians, we're not going to try to read it because we know that's not kosher. But, you know, some people get curious. They need to have those blocking screens so people can't see what they're working on.  But pay attention to the physical attributes. If you have an office on the first floor, obviously, second floor and above are not an issue. And you have your back to the window and there's a walkway right outside. Chances of somebody looking in the window and reading the PHI pretty small, but it's probably best to have at least some sort of shears over it just to be ultra. Ultra safe. Implement physical safeguards for all workstations that access electronic PHI to restrict access to unauthorized users. This includes printers and fax machines. Now, we want to protect what comes out of the fax machine. Like I said, I worked in one place where we had to send everything to a central fax machine that was not in a secured area, which was, you know, kind of bad mojo. In my opinion. So whoever can access those paper documents, we need to make sure that they have a reason to have access to it. And, you know, they're cleared and all that kind of stuff. But it's also important to remember, especially on those big copiers, most of them have hard drives in them. So you send something to a copier and maybe three other people sent stuff to the copier at the same time. It gets stored in the hard drive on the printer. So then it gets printed out, but you need to make sure that, you know, what happens to the data on that hard drive? Is it encrypted? You know, ideally that's what you'd be asking your copy guy. And how is that data handled? Again, business associate agreement. When you get rid of the copy machine, or if you have to get a new hard drive for your copy machine, what happens to that data? Not something to be concerned about for your, you know, little desktop printers. They don't have any long term memory. And once you unplug them, you know, everything's pretty much gone. But it is important to understand that, you know, some things get held in this temporary memory or even on a hard drive. I think one of the places I worked, it would store the last 400 pages that were printed. So that's a lot of protected health information. Implement policies, procedures that govern the receipt and removal of hardware and electronic media, such as thumb drives and laptops that contain protected health information into and out of the facility and the movement of these items within the facility. So, you know, think back to recent government scandals where information was on on a laptop on an iPad on a blackberry, and it wasn't effectively wiped before it was given to the next person. Or, you know, the information wasn't effectively disposed of. So there's required to be a written policy for how you're going to dispose of things that have protected health information. So is it going to be destroyed? Is it going to be wiped? And typical wiping doesn't completely clean up the drive. There are shredder programs that you need to use. You need to consult your IT person for the programs that you need to use to make sure that the data is not recoverable.  That's not disallowed, but there needs to be a process for removing the PHI of the people before you. One place that I worked at, instead of removing the PHI, they would just set you up a new profile and leave the other person's PHI on there, which is technically not HIPAA compliant. It needs to be removed before you have access to it. Now, yes, you would probably have to be a hacker to be able to get in there. But to be ultra safe, it's, you know, definitely best if you completely wipe the PHI before the device, even if it's a thumb drive, goes to a new person. Make sure that anything you use is full-disk encrypted.  And obviously I'm not the tech person in our agency, but you can get those. They're not overly expensive, but it is important to make sure if you're going to put something on electronic media that it is encrypted. And I know I sound like a broken record. Accountability. Now this is not required, but it's addressable. Maintain a record of the movements of hardware and electronic media and any person responsible, therefore. I love how they use their for in legal documents. Anyway, so have a log of who's got the got the information, you know, if Jane has computer ABC, and then she quits, and it gets reissued to Sam, then Sam needs to sign it out. I think most agencies do a pretty good job of tracking that information. You also need to track when that in that particular device is taken out of service and how it's destroyed. Technical policies and procedures for electronic information systems that maintain protected health information to allow access only to those persons or software programs that have been granted access rights. Think LinkedIn or Google. If you have, if you do any surfing on the net, you are probably familiar with the fact that you can go and search for something on, you know, Firefox or whatever browser you're using. And then all of a sudden you're getting served ads for that same thing everywhere you go.  LinkedIn and Google and some of those other places may access information theoretically not for nefarious reasons just for marketing, which you may consider nefarious but that I digress. But they can't have access to PHI. So you've got to make sure that if you have client data, you know, again going back to don't want to be using Gmail. You have client data on your computer that no other third party programs can access it unless you have given them explicit permission. You need to have a unique user identification. Emergency access is required. And again, this goes back to the access portion of HIPAA. You need to be at be able to access data from a remote site during a natural disaster, for example, or staff may need to access it in medical emergencies. Another example, when I was working in clinic, we used to have paper charts before electronic health records, they were all locked up very securely. So when the billing staff and the staff who handled all of the charts were not there. Nobody could access that data. So if we would have a client fall out, and we would have to residential facility, and we would have to call EMS, we couldn't get to the chart right away. So eventually they put in a safe and the program director had the combination to the safe, but whoever was on duty had to call the program director to get the combination. It was a big issue. So it's important to make sure that whoever needs to access it can access it. So automatic log off is addressable. Like I said, most of the time agencies have it set so after a certain period of inactivity, your computer automatically, it doesn't just go to sleep, but it locks. And that's a good thing to have. Okay uses and disclosures and we're going to get into this a lot more in the second half, but it is important to understand and we all do that HIPAA has big issues on uses and disclosures. A covered entity which is clinicians us is permitted to use or disclose PHI to the individual for treatment payment or health care operations, or required by the secretary under subpart C. Generally, there is not a big issue with disclosing information to the individual. Now what information you disclose that can be a matter of policy and whether they have access to progress notes and we'll get into a little bit more of that later. But individuals do have the right by HIPAA to access their medical health record, or at least a summary of the data there in. When using or disclosing to P or requesting PHI from another covered entity or business associate make reasonable efforts to limit the PHI to the minimum necessary to accomplish the intended goal. So, again, if you're asking for information from somebody. You don't need to necessarily know their HIV status and their last 17 progress notes and yada yada, you need their assessment their discharge summary their treatment plan. And it's important to only give the minimum necessary unless you have a specific written disclosure that where the client saying I want you to give, you know, new clinician Jane all of this information. This requirement does not apply to and this is where our legal department is great, because there are a lot of caveats. It doesn't require to disclosures to or requests by a health care provider for treatment. So for continuity of care, you don't have to give the minimum necessary and drag your feet. If the clients dot calls you and you know it's their doctor uses or disclosures made to the individual, you don't have to give the minimum necessary. It doesn't mean you won't, but it means you aren't required to only give the minimum necessary. There are other disclosures that are required by law. When we think about mandatory reporting responses to subpoenas we'll get into that later. Or disclosures that are required for compliance with applicable requirements of this sub chapter, such as, again, if there is an investigation of billing practices or something. Law enforcement or the investigating agency, the Secretary of Health and Human Services may request certain information. Whenever you don't have a signed disclosure and you're disclosing to anyone besides the individual, my recommendation and I'm not a lawyer. My recommendation is always to check with legal if at all possible and keep it to the minimum necessary. So a good common sense goes a long way here. As a general rule, authorization is required. A separate authorization and a lot of agencies actually have never seen a separate authorization for psychotherapy notes, even though it's required. You cannot combine request an authorization for release of general chart information with one for psychotherapy notes. Authorizations required for psychotherapy notes, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except to carry out the following treatment, payment or health care operations. It's used by the originator of the therapy notes for treatment. So if you're giving it to someone else, you know, and that kind of conflicts with what we heard earlier about if you need to share information for the continuity of care. So that's where legal comes in. You can use it in internal training programs, it's best to take the information and redact any identifying patient information. And you don't need a separate disclosure for psychotherapy notes. If you are defending yourself in a legal action or other proceeding brought by the individual against you as the clinician or the agency. Authorizations are not valid. Yes, we are bad about these a lot of times, which is why it's all blue. If the documentation has the following defects, the expiration date has passed or the expiration event has occurred. And in response to the question about whether this varies by state or HIPAA is overarching HIPAA is a federal requirement. The states will also have requirements and restrictions, which we'll talk about, for example, when we get to notifying people about communicable diseases. So states may have more restrictive guidelines that, you know, add on to HIPAA, it's really important to be aware of. If the expiration date has passed, so if you put on there for the duration of treatment and the client has discharged, then that treatment authorization is no longer valid. It is better to have an actual date. If the authorization has not been filled out completely, please don't have blank signed authorizations in your chart. It makes my skin crawl whenever I see that because so much bad can happen. So if a client needs to have to sign an authorization, they're just going to have to bring them happy selves back in or mail a written one to you. If the authorization is known by the covered entity to have been revoked and there is debate on this. So again, consult legal about whether the revocation can be verbal or it has to be written. My training has said verbal or written revocation is sufficient to invalidate the authorization. So look at your authorization documents and see what they say when somebody is signing a release of information. Does it say they have to revoke it in writing or can it be verbal? But again, from an ethical standpoint, if I know in good faith that my client has revoked authorization, even if they haven't given me written revocation yet, I'm not going to release that information. That's me. Authorization is also invalidated if it's known to be false. So if you know somebody put false information about their date of birth or who they are, you know, John Smith comes in and is trying to get information about Jane Doe. Well, I guess that wouldn't work about Sam Spade. So John Smith fills out the authorization as if he were Sam Spade, which is why you need, if you're not known to the person, why you need to have a picture ID to verify that the person is who they say they are. Compound authorizations are authorizations for the user disclosure of protected health information. And they may not be combined with any other document to create a compound authorization, except an authorization for user disclosure of psychotherapy notes may only be combined with another authorization of psychotherapy notes. So you can't, again, you can't have the psychotherapy notes in there with the discharge summary and the assessment and all that other stuff. You also don't want to have it as part of a authorization for release of information and a consent for treatment or something. You need to be very specific and, you know, notes or something that they're very clear need to have their own authorization. An individual may revoke an authorization provided under the section at any time provided the revocation is in writing. But to the extent and remember I said that some agencies are good with a verbal revocation. You've got a little bit of backup if you insist that it has to be in writing be with this section right here. But again, we're going with looking at ethics as well as the letter of the law. So if they have a person can revoke their consent for release of information in writing, except if the covered entity has taken action in reliance there on. So for some reason you need it in order to complete billing or something else where if they revoke it, it significantly hurts the agency. Then that could be that could be a problem and potentially you could deny them the ability to revoke their authorization. Or if the authorization was obtained as a condition of obtaining insurance coverage. Other law provides the insurer with the right to contest a claim under the policy or policies itself. So if you're trying to get insurance and I know this is going to be a big one eventually if they go back to pre existing conditions. If you're trying to get insurance and the insurance company wants to see your records to see if you've had any sort of pre existing condition and you revoke that consent and you say no you're not allowed to see you're not allowed to give information to blue cross if they want to find out about anything about me. The insurance company can choose at that point to either say no we're not going to cover you, or if you want us to cover you, you must allow release of information. So core elements of authorizations and there's a lot of text here I'm going to kind of go through it real fast and summarize it. A description of the information to be used or disclosed. Specific and meaningful client data is not specific and meaningful assessment attendance, drug screens, discharge summary treatment plan, those are specific on our release that we have we have checkboxes. So we can check the different things that need to come out saves a little bit of time. The name or other specific identification of the person or class of persons authorized to make the requested user disclosure. So who's disclosing it and it's either the person or the person's legal guardian. The name of the persons who are going to receive the information. A description of each purpose of the requested user user disclosure, the statement at the request of the individual is sufficient. Of the purpose when the individual initiates the authorization so you don't need to go in if the individual initiated it, which is most of the time, like 99% of the time. All you need to do is put at the request of the individual, not specifically why they want everything released. The expiration date or expiration event that relates to the individual or purpose of the user disclosure, you cannot have an open ended release of information. Typically in the facilities that I've worked at again co occurring disorders so we typically have clients step down and in treatment for a little while. We would either do three months, six months or one year from the date of initial treatment as a general rule and making sure they knew they could revoke their consent for release of information at any point in time. The person needs to sign and date it. If a personal representative of the individual you're dealing with a individual who is not able to sign for themselves because they're not of age or they're not competent. We need to know what the authority of that person is, is it their attorney, is it their legal guardian, is it their parent, yada yada. In addition to the core elements, the authorizations must contain statements adequate to place the individual on notice of the following. And generally this is at the end of your release of information. And I know I'm going through this in just extremely minute detail, but it's important because we use these so often. The individual's right to revoke the authorization in writing and the exceptions to the right revoke and how the person may revoke the authorization need to be down there, or the ability or inability to condition treatment, enrollment or eligibility for benefits on authorization by stating that the covered entity may not condition treatment on whether the individual signs the authorization when the prohibition on conditioning of authorizations and paragraph before of this section applies. In certain situations you're not going to be able to deny treatment if the person says I'm not giving you a release of information. You also have to have the consequences to the individual of a refusal to sign the authorization when the covered entity can condition treatment on failure to obtain such order authorization such as court ordered treatment. So and this came up and this is also true with some insurance but this would come up with me when I used to work with clients who are ordered by the court for treatment. If they did not release sign the release of information for their probation officer. I had to, you know, make them known, make them aware ahead of time that this would probably result in the violation of their probation. That's just the way it was. They were coming to us as a result of a court order. And they could talk with their attorney and do all that kind of stuff. However, if they didn't sign the release of information. These were the potential consequences. And you do need to have the potential for information disclosed pursuant to the authorization to be subjected to redisclosure by the recipient and no longer be protected. So if you give it information to somebody else like John Smith wants information released Sally Sally Sue. We need to have a statement at the bottom that says we can't guarantee the security of your information if we release it to this other person who is probably not protected under the HIPAA requirements. Plain language needs to be there no legal ease no therefore is no party of the first part it has to be written so the average person can read and understand it and the individual must get a copy. HIPAA indicates which situations in which situations information may be disclosed. However, many agencies and providers are bound by other regulations such as the code of federal regulations 42 part two, which applies to any agency that provides substance abuse treatment, as well as state regulations which may be more rigid. Seek guidance from a qualified legal professional regarding implementation of HIPAA and confidentiality requirements. This presentation reviews highlights from HIPAA code and is not a comprehensive guide for confidentiality or HIPAA compliance. HIPAA requires that written and electronic protected health information be maintained with reasonable security. Providers must implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access to only those persons or software programs that have been granted access rights. Providers must have policies for emergency access such as in the case of a natural disaster or medical emergency and are required to develop and implement written policies and procedures that establish document review and modify a user's right to access a workstation, transaction, program or process. And I will give you a hint. This chart or this slide is going to be important to you in the very, very near future. HIPAA requires that PHI be backed up and stored in a secure location and that electronic PHI be encrypted, wiped from devices before reissuing them and maintained behind security protocols which limit access to only approved people. A separate consent must be signed for psychotherapy notes and a valid consent for release of information must be completely filled out and contain certain very explicit information or it is invalid and disclosure based on an invalid release is prohibited. Breathing. Okay, so if you are in a private practice situation and do not have access to a legal department, what would be a good resource for legal advice for EPHI information and guidance? I would start with your local or not your local but your state board, your state ethics board and see if they have free legal advice. Look to universities in your area that have law schools. A lot of times they have law clinics where you can get advice. There are also services and it used to be called prepaid legal but that you can sign up with that can help you for a minimal charge. I don't know what we pay for month per month anymore when we signed up it was like $7 a month or something but you can access an attorney at any point and run questions by them and get some minimal stuff answered. The other place that you might check is with your insurance provider. So whoever does your liability insurance, they are wanting to make sure that you aren't held liable for any sort of HIPAA violations either. So they may have some suggestions. They may have some training on it if you don't have a legal department to access. Those would be the first places I would check if I was looking for low cost and affordable access to an attorney. If you enjoy this podcast, please like and subscribe either in your podcast player or on YouTube. You can attend and participate in our live webinars with Dr. Snipes by subscribing at allceuse.com slash counselor toolbox. This episode has been brought to you in part by allceuse.com providing 24 seven multimedia continuing education and pre certification training to counselors, therapists and nurses since 2006.


The one thing I'm excited to teach you today is the fastest way to pickle cucumbers. Can I get you? You'll need some cucumbers. I like curbies. They stand up really well to pickling. They stay crunchy in the fridge. And we are going to smash them apart because this skin right here is what is preventing your cucumber from pickling quickly. But if you smash them apart, you can actually get that brine into the entire cucumber. So what you're going to need is a smasher. I like using a nice heavy cast-iron frying pan because it's got this sturdy, flat bottom. But you can use a rolling pan. You can use a meat tenderizer. Really anything you have in your kitchen. You have no excuse for not doing it. So we're just going to go right in. Smash it. The pulpy, seedy core that's not really great for pickling just pops right out. Pack these cucumbers in really, really tightly because it's the compression against each other. That's going to press the juice out of the cucumbers and allow the brine to absorb. Keep smashing. So now that we've stuffed the jars, it's time to add the brine. Pickle brine is exceptionally easy to make. It's two parts vinegar, one part water, a dash each of salt and sugar, and anything else you like, whatever floats your boat. These are ready for the fridge. So these pickles have been chilling in the fridge for two hours. And we're going to try them out with a little help from my boss, Eric. Eric. Yes. Nice to see you. Nice to see you, too. I happen to know you like spicy pickles, so let's open these first. Okay. Crunchy. Crunchy. Pickly. Sour. It's been pickling for more than two hours, perhaps? It tastes like a pickle you got from the farmers market. That's a nice compliment. Thank you. It works. Amazing. All right, two hours. If you have two hours and an implement of destruction, you, too, can make smashed cucumber pickles today.


What's up everybody, Jason here for Jasper's CaseBrace.com. This is our last filler to unlock 13 spots in our baseball mixer. You're getting 13 different teens being given away here guys. This is a 2022 Top Stadium Club baseball one-pack hobby break number one. And again guys this was a promo break so if you go look here in the promo section you'll see that's there it's sold out. So we had to sell these breaks here in the item description by tomorrow night so we're rocking and rolling guys only one break left. But basically only the customers that bought into the filler are going to be and not the customers in the mixer itself just the filler. So I just want to show you guys there. I'm gonna cross out that next break here. So like I said now just eminence plus any fillers remaining. Oops sorry that's the wrong way to do it. So just got to fill the eminence and then I'll get the list of names right now and I'll paste them here to the bottom. So you guys are in there too. Let me copy and paste this I guess. Actually you know what let's do it later. I want to just leave the font the same. Alright so I'll paste those names in later. I just want to get them from the Google Doc better. But let's do the break first and then at the end of the break guys we'll gather up all the 30 names randomize them and 13 out of the 30 will get a team and I'm gonna paste the teams right here really quick. So top 13 are in and we'll do the break first. So here we go let's do the break roll it six four ten times good luck one two three four five six seven eight nine six four ten Ed down to Michael and we got ten times here one two three four five six seven eight nine ten Cleveland Gardens out of the Oakland A's. Alright again you're gonna stick to what you got guys it's just a quick little hobby pack still chance of an auto or numbered cards but just it'll be pretty quick so no bother trading any teams and let me also to really quick paste this in the title page. So just eminence away guys for that promo. Alright so let's do the break first quick little pack filler. Sasuke rookie and Matt Brown. There you go switch and scenes now guys. Here's the dice roller here's the customer names and now again remember top 13 get a team from the Angels down to the Giants. Let's roll five three eight times good luck one two three four five six seven eight. Boom eight times eight times so we're 13 and up so Ed and Devin are in. Michael Garrett Joe Michael Michael Garrett Garrett Cassandra Michael and Ed there you go so just gonna paste the whole list but only top 13 are in. So Ed you have the Angels Michael with the Yankees Cassandra with the Seattle Mariners Garrett with the Tampa Bay Rays Garrett with the Atlanta Braves Michael with Boston Kansas City Rose with Michael as well as Washington for Michael Joe with Baltimore Garrett with Pittsburgh and Michael with Toronto Devin with Chicago Cubs and then Giants for Ed. So again coming up next guys is the break itself good luck.


Welcome to the program. Your home is my home. Our guest tonight is Brad Phillips from California. Brad, tell us a little bit about yourself. What do you do? Well, at the moment I'm working as an English teacher in Tokyo, Japan. Tokyo is an exciting city, but it's also very spread out. It can sometimes take hours to go from one part of the city to another. When I don't feel like going all the way home, I sometimes stay in a capsule hotel. A capsule hotel? Can you explain what that is? Yeah, it's a hotel with lots of small rooms. Actually, they're not really rooms. They're spaces that are two meters by one meter and only a meter high. In other words, they're very cramped. But the hotel is cheap and very convenient. And what's inside each little room? Or should I say each space? Well, inside every capsule there's a bed, a TV. A TV? Really? Yeah, and a reading light, a radio, and an alarm clock. The hotel also has lockers where you can keep your personal belongings. Interesting. So what kind of people stay in a capsule hotel? Well, probably people like me. People who miss the last train home or don't want to go all the way home only to turn around and come back to work again. It gets pretty busy, as you can imagine. Finally, would you recommend a capsule hotel to other people? Sure, the rooms are small, but you get used to sleeping in a small space. I just wouldn't recommend a capsule hotel to people who can't relax in small, cramped spaces.


BDS India, People's Dispatch and NewsClick, have together produced a report on military ties between India and Israel. Following extensive research, including tracking ongoing arms deals, this report contextualizes their scale, which is approximately $1 billion annually, in the growing paradigm of security collaboration and ideological symmetry between India and Israel. From a policy of unconditional support to the Palestinian freedom struggle to becoming an important ally of Israel's apartheid regime, India's changing stance on this issue is co-terminous with its own journey towards fascism. Israel's military technology and methodology has perpetuated over seven decades of occupation, apartheid and settler colonialism against Palestinian people. India's import of them is ominous. It threatens the right and liberties of ordinary citizens. It is a model of permanent insecurity and suspicion. The volume of this arms trade is detailed in a lectures provided with the report. While not listing each and every deal, as the information about many of them is not available in the public domain, the report manages to give an estimate of the large scale of public money spent on importing Israeli weapons. It also shows their use and deployment. Israeli travel rifles, for example, are widely used by Indian parliamentary responsible for internal security in conflict zones such as Kashmir. The corruption of Israeli defense industry spills over to India, where the high-profile Barak missile deal was subject to a CVI inquiry. The spike missiles deal has been cancelled and renegotiated multiple times, presumably under political pressure. An emerging trend is that of Israeli public and private defense companies entering into joint ventures with Indian companies. This includes a facility for producing the notorious Hermes drones developed during the 2014 Gaza massacre for which al-Bitt systems, Israel's largest private defense manufacturer, Adani Group, known to be close to the regime, have come together. India does not have a private defense industry, per se, and though not alone, but this might mark the beginning of a private profit-oriented defense sector. Visiting Indian police officers have been visiting Israel for what can only be a training in profiling, surveillance, and militarization of police. Indian Army has conducted several joint trainings with Israeli forces, including in Kashmir, where the ultra-right-wing central government has abrogated its special status. Israel-style illegal settlements in occupied West Bank would soon be copied here. It is already one of the most militarized zones in the world with flagrant human right violations. Here invocations of Israel's tactics by the Indian state are not just a foreboding but very real and everyday affair. India is putting electric fences on its international borders, the inspiration for which are the barriers that impose the seas on Gaza Strip. Israel's weapon industry develops and field tastes its technologies on Palestinians during massacres, the revolving door between the occupation forces and the defense industry, and also the universities that produce war doctrines make it a unified whole. This matrix enforces a perpetual insecurity where any manner of human rights are subservient to what is perceived as security, apart from profiteering from the illegal occupation. The import of weapons from Israel comes with this package. This model is not new for India, where in the last decades, persecution and even violence against Muslims, students, indigenous groups and dissenters is becoming normalized. Israel adds on edge to this hypernationalism evidenced in the recent hacking of cell phones of activists and lawyers with NSO Group's Pegasus spyware. Given that this spyware is only sold to law enforcement agencies, the government has resorted to stonewalling any questions in this regard. Israel's purchase of Israeli weapons finances the occupation of Palestinians. More specifically, billions of dollars of Indian taxpayer money is spent on killing and maiming Palestinians. In turn, collaborations with Israel are intensifying militarism and securitization in India. It is normalizing spying of dissenters, perpetual suspicion of citizens, and use of disproportionate violence as long as it is for security. This is a downward spiral which can only be stopped by popular movements. The recent protests against India's new citizenship law have broken a long silence in the face of growing right-wing nationalism. The new citizenship law itself mirrors Israel's law of return. This is a moment for all of us to question the dangerous collaboration between India and Israel. We need to come in support of the Palestinian call for a military embargo on Israel and challenge growing militarism in India. Please read our report and send us your feedback. You can find a link to it in the description of this video.


Welcome everybody.  I'm Cliff Lynch, the director of the coalition for networked information and you've reached one of the project briefing sessions for the third day of the second week of the CNI fall 2020 virtual member meeting. We do have closed captioning accessible a recording of this will be available. There is chat available and Diane will moderate Goldenberg hard from CNI will moderate a few questions and answers at the end. I apologize one more time for the connection problems. What we're going to do is we're going to pass this over to our speakers in just a second.  So we will do a full 30 minutes till 40 Eastern time. I will just say very briefly that this presentation addresses one of the critical issues about the relationship between libraries and the research enterprise, which we know has become an absolutely pivotal organizational challenge and community and I'm going to turn it over to Nina Exner from Virginia Commonwealth University, who will start the presentation she will be joined by Steven Bollinger this head of systems at North Carolina agricultural and technical State University over to you Nina. Thank you so much for your time. Thank you so much for your time. I am staying with my camera off because I've been having technical problems and apparently I brought the Grimm ones with me to jinx the entire session. So you're not seeing me, but thank you for coming to our session. I'm Nina Exner. Please go back up. I'm sorry. I wasn't ready for the next slide. But I'm mostly going to be concentrating on a program that Steven and I started at North Carolina agricultural and technical State University Steve would you like to introduce yourself. I'm Steven Bollinger I'm the head of library systems but again being at a medium university I wear many hats so I am also a liaison librarian and that's what I'm here to talk about today, how both of those things work together. And this is actually a rather old project, but thank you. But we wanted to bring it to your attention for, because it's become more important in the, in the profession. So first, let me touch on what the research enterprise is in case you're not a research enterprise geek like we are, and haven't heard about this term before. It's a kind of generic term for all the stuff on campus. The stuff is the technical term I suppose that works towards getting or keeping or increasing grant funded research and all the different people who work on getting and fulfilling grants. And you may think of the Office of Research, which could have any of a number of names at a and T, it's called Dorad at VCU, it's called OVPRI, and at many places it's just called Office of Research. That's what the research administration professionals usually call the central office. And at research universities that central office is probably a much more complicated place than you think it is, in much the same way that people who are not librarians think that libraries are sort of a monolith with two or three different roles and everyone's a librarian, or IT is a lot of computer guys sitting doing programs, or, you know, much the same way that outsiders tend to be unaware of the nuance and I want to touch on that here and I'm going to bring it back later, because it's an important part of our, what made this project successful. There are also departmental research administrators though, and other professionals in each department at a university that are part of the research enterprise and that's why it's a whole enterprise not just the central office. Furthermore, there are core facilities at many larger institutions, if you're at an R1, R2s that may vary, and usually there are centers and institutes and all sorts of other things, as well as the people we usually think about getting grants, the faculty, and the postdocs. Next slide. Why should you care about the research enterprise? Well, I want to be realistic here real quick and say, possibly you should not, depending on your institution, that's going to sound weird since I'm talking about it, and I do think it's an important topic but it is very time intensive. So you want to think about the role of your campus strategic plan. If your strategic plan, like the one at NCA&T, when we were doing this and still now, really focuses on increasing grant funding, not fundraising, not donations, those are held by a very different department and go through a very different process, but increasing research grants, if that's a big part of your campus strategic plan, then this is a good role for IT and libraries and all the other teams that are involved at CNI may want to look at. But if it's not a big strategic, part of your strategic plan, this may just be an interesting talk to hear, but not more relevant to you. I think two core pieces you may want to look at are the CNI Symposium proceedings from last year on libraries in the research enterprise. And the very recent OCLC report I saw Rebecca Bryant at one point on this list on social interoperability in research support and a lot of ways that is what inspired us to want to talk about this project right now. Next slide please. At the critical role symposium, which I did not have the pleasure of attending because I somehow managed to miss that it was happening. There was a whole lot of different challenges discussed. They did breakout groups. And they talked about a lot of strengths and benefits and great projects that were in place. I cannot recommend enough looking at this report. But there were a number of challenges and the project, the approach of liaisoning, not just talking to but liaison style outreach addresses some of those. These are a few of the different ones that were listed in that symposium. So I'm not going to read them out, but you can think about it in the context of that, especially if you were at that symposium. Next slide please. We'd already said what the research enterprise is. Next slide. But what you should not be taking from that is blah, blah, blah, blah, blah, vice president of research, blah, blah, blah, associate deans of research, blah, blah. That's not, that's often what people think of as the research enterprise, but it's not the best way to approach building relationships with the research enterprise. It's not to say that your vice president or vice chancellor isn't a critical touch point, not to say that ADRs aren't one of the major lynch pins that hold together the research enterprise. They're not good contacts, but they're super busy. They don't get into the nuts and bolts of things. And so they can be good contacts, but one, but they shouldn't be considered the whole of or even the key contact point for nuts and bolts getting things done with the research enterprise. It's my turn. So let's talk about how this approach is different. Nina has mentioned the library liaison approach and our institution pivoted like many of you have from being bibliographers into a liaison model. And of course, again, as mentioned earlier, but for those who missed it, we have, you know, the medium sized institution we wear a lot of hats. So I look at the library liaison approach as an important way to deal with this one of the things that I work with my colleagues to so that they understand is that really a library liaison is a consultant. And I approach it in that way. So in this case, one of the legwork pieces that you have to do is really look for understand the landscape of research on your campus. What activities are underway? What are the priorities? What are the needs? One of those things that you can do is actually attend meetings or ask to attend meetings. So all we all know that's very challenging in the time of zoom and social distancing and people aren't in their offices. But it can still be done. And especially when it, you know, hopefully when this is all over soon, it's definitely something that you can do as a library liaison, whether whether it's working with faculty in an assigned college or department or unit, or whether it's reaching out to, again, your campus's research infrastructure, whether it's one of the centers, whether it's the actual office of sponsored projects or anybody in between. So it is a reactive model in that way, because you are looking for opportunities to provide assistance. But you can't just dive into this, you know, thinking that you know all the answers, and you also can't, you know, go in talking about books or things because people's minds just close right down. The ideal is that this really does demonstrate the social interoperability that OCLC has coined and that really it allows us to facilitate communications because of our multidisciplinary and interdisciplinary connections that we can make, sort of being a neutral party on campus that has exposure to a lot of different disciplines and ideas. So what is networked information about it, since this is the coalition for networked information. One of the things that Nina and I found very quickly, and personally I found even quicker than Nina was that a lot of the research professionals just don't get technology. It's something that's seen as a check box that, you know, we'll handle that later or there's IT people for that. And they don't, you know, that's not their passion, right. So having someone that is involved in the process who has a grounding in information technology, and has an understanding of what the challenges are in that space can be very, very helpful, especially with setting realistic expectations around capacities, capabilities, budgets, that kind of thing. Understanding the technological aspects of research computing is a major challenge for a generalist like me, but at the same time I know enough that I can be very helpful, especially in proposal development, reviews of proposals, these sorts of things. It's an opportunity to help faculty and researchers and the Office of Research know that there are going to be specific issues around research computing that will need to be addressed. On our campus, one of the big challenges was we have a shared research facility. It's the Canapalus Research Facility. It's part of the UNC system. And of course, the minute that I say UNC system, you know, the optimists are like we're all holding hands and singing kumbia songs. The reality is that three years ago, none of our researchers, faculty or graduate students from that facility could access the campus network, which meant they had no access to any of the library's license databases. They were locked out of our campus. So as an information technology person, having established myself on campus as a good collaborator in information technology space, having a relationship with my campus information technology organization, as well as having the communication and entree with the research people allowed me to attack it a couple of different ways. One, I had to do a top and a bottom approach, which is at one level I went to the CIO and said, you know, this is a big problem. We have a major research facility and none of our community can access our own campus's resources from there. And then a bottom up, which is going to the help desk sort of IT help desk level and saying, you know, okay, helping students and faculty raise this issue from that side. And of course, immediately they told us, well, just have them use the VPN, the virtual private network, which this is a, this is a sensitive research facility so the network is locked down our VPN would not connect. So it took about 18 months to sort of navigate this situation where it's like a student came to us with the problem at first a PhD student, and it came up in a research consultation about something else entirely. But it was like, well, why are you coming to Greensboro and you're in Kannapolis and the student was I can't access any of the stuff from Kannapolis I have to come here. So, moving that through finding out who the advisor was tackling it from that side understanding the faculty perspective the researcher perspective, and then getting the campus IT people to understand no you can't just tell them to use the VPN it doesn't work. Identifying who in the campus infrastructure group was responsible for firewall and for security and the VPN, and then connecting them with the IT person at the Kannapolis facility who is employed by a different university and the IT system to get them to talk about creating a private VPN tunnel between the Kannapolis facility and our network so that they could actually access our resources. So it can be done. It's very helpful. But it, it takes a long time and it takes a lot of commitment to impatient to meet the right people to make sure that the right people are talking to each other and to say the right things. So, as sort of intimated there there's there's islands of expertise across campus and they can be located one of one of those islands frankly is the library. And the other islands exist all throughout these centers colleges departments units and and obviously research itself. There are things that librarians could do in having, you know, a mandate in our very existence to be interdisciplinary and multidisciplinary and work across campus. We can connect people in ways that other people just don't they don't encounter it or there's there's not an opportunity for them to understand. The other part of it is that it as a vocation sometimes takes pride in making people feel dumb. And that's unpleasant for anyone people, you know, the people that you're dealing with, especially in research, competing in grant development are talented researchers. They are professionals they are committed to what they're doing, and they don't like it people coming in and saying well you haven't ever heard of this or thought of that. So, you have to approach it with the sensitivity, which, you know, I think people who are systems librarians and who are in this field are there because that's what they enjoy is making technology work for people. So, in this case coming in with that humility and coming in with that ability to try and reduce the complexity of it, but it make it understandable is really important. And that leads to the sort of final challenge which is okay well there's only one of me on campus and there only was one of nine and she departed so how do we scale this and provide a continuity of service across, you know, years to the to the research enterprise. And part of that is that we do professional development amongst ourselves. And part of that is that we approach things in a team format. So, again, when you're undertaking this it's very overwhelming it was overwhelming for me as a junior faculty to start this 10 years ago. And I know it's overwhelming for my peers. So, one of the things that we've talked about in the professional development that I've done in my organization is to again to treat this as a consulting issue. And to look at it from that way to bring something to the conversation. You can't just stumble up to research people and go the library has stuff. The office the technical term is nine and pointed out earlier. You need to bring something to them that they're already interested in or looking for or might need. Again, this is why you go to a lot of meetings that maybe have nothing to do with you undergraduate research meetings.  If you're, if your research office is putting on seminars and workshops, even if they're on zoom, even socially distance now. And you have your name seen in that participants and attendee field. And this, you know, you'll hear what your colleagues are asking and you'll hear what what those workshops are meant to address on campus. And then you can play matchmaker to figure out well is this something I can provide this is something that I can work with one of my other liaisons to provide. Most of the time when I engage as a liaison in this space, I do it as a team. I do that for continuity in case I move around vacation or offline or whatever or sick or anything. And I also do that because again I'm an IT professional not necessarily a subject matter expert. So, um, that team approach is really important, both again for continuity to pass those skills on. And my example about this, which is actually sliding from the other slide to this one is that we had a talented researcher in our Alzheimer's lab, which is an NIH funded facility. And the researcher was having difficulty with red cap which is application that they use to capture data for human subject trials. So, in this case, anti actually belongs to again a part of the infrastructure of the UNC system. We have shared membership in a center that's on UNC Chapel Hills campus that provides red cap services for researchers, but the researcher in this case had somehow knew about the center and knew that existed but was under the impression that it required a consulting budget in order to use the service and she's working on a grant. She's filling a grant actually her budget is committed it's spent she doesn't have any money. So she approached our STEM librarian about this issue and then he very quickly called me and on the scene and said well this is it stuff. Well I didn't do any IT stuff but I did. I was able to do something that helped our, our faculty by introducing them to the director of the center, and clarifying to them and, and making that introduction clarifying to them that there was no cost custom development was required to use that application. And I also in the process introduced my colleague into how you do a professional introduction across the campus, and, and how you should handle this kind of situation. So, again that the team approach and spreading those skills out, not only provides continuity, the researcher now can contact either of us and get an answer for whatever their problem may be. That also means that where I fall down and don't I'm not a health person. I'm, that's not my thing. That's not it is my thing. So, having somebody there who had the sort of life sciences background to be able to deal with those issues was invaluable. Minding time here. So back to Nina. So, there, Stephen gave a couple of really good examples of recent projects at anti. We actually had so many specific small projects that we put them in a timeline, which is appended to the end of the slide deck that was uploaded. And the reason for that is because there were a lot of small things that came up that the library could do technologically, or through instructional and literature services. So, this project as a whole that we're speaking on is really the project to treat the office of research as a liaison unit and the same things that one might do to be a liaison in library subject terms could be done. To the office of research or and or to the departmental research units, because no one knows what we do in the library or in it, even people who are really library or technology or academic technology advocates tend to simplify what it is that we do. Likewise, we tend to simplify what it is that research staff and research administrators research professionals do. So, the process of liaisoning spun off a lot of different projects, some small, some big. So, the, the goal is to sort of keep in mind throughout that visibility and attendance at different office of research or research enterprise events are it's going to have long term benefits to help make the organization more visible and help create projects. So, I'll give a really simple example of one of these benefits before we transitioned at a and T was that they needed someplace to put up PDFs that were subscription restricted access, but they weren't being the subscription was that the PDFs were emailed to the office. So don't ask me why it couldn't be managed through a normal subscription because the organization producing the magazine was just not that large. And so we used electronic reserve systems for a while to create a sort of digital library for them. There are a lot of little things like library guides like reserves, like the ability to operate zoom until everyone went home and started using zoom I was a touch point for zoom at the office of research and both institutions sometimes. More recently as I transferred to VCU, a lot of those same skills helped me kind of hit the ground running, but I still do the same approach. So I might go to something about how to handle reimbursement for vaccine trial participants and how how credit card payments are handled and I don't care about credit card payments for vaccine trial participants, but possibly in the in the course of that some brief of how that can integrate with data management, which is my job might come up and I might be able to message someone to say hey we could have a meeting about this. So taking this liaison sort of approach helps to build gradually a strong relationship with the research enterprise. But if you have a strong relationship with one part of the research enterprise, it doesn't mean that you know all of the possibilities. I'm pretty strong with certain parts of my enterprise but their departments where I know the research administrators, but I don't work with them yet I haven't made that connection. There are always more units to to talk to and more roles that you can take on so if you're doing maybe data management now and you've got a tight relationship with the pre award dmp writers that doesn't mean that you've even exhausted all of the data management possibilities, much less all of the research enterprise possibilities, and looking at the time I should stop there. And we should go on to the next slide, so that we can have our beautiful pictures up and the ones that look somewhat professional. And this is our contact information. And we're ready for Q&A. As I mentioned before, there's a whole timeline in the slide deck of some different points of how this relationship more more prosaically evolved maybe if you want details on that. Terrific. Thank you Nina. Thank you Stephen for that wonderful presentation and under duress, no less. We appreciate you rolling with the punches that was really great and very interesting. And of course the floor is now open for questions. So please go ahead and type in your questions. There has been some active chat, and I see that Rebecca Bryant is has dropped a question into the Q&A so let me get to that now. Thank you Rebecca. Can you talk about what's most difficult in this approach, or if you had a magic wand, what would you fix. Although Rebecca's heard me talk at some of the research enterprise professional meetings to so that she may have already heard this, but I think the most difficult thing is actually the jargon barrier. So I'll give an example of working with the RIO, the Research Integrity Officer. So the way that research integrity uses the phrase data management is different from the way that libraries use the phrase data management. And so several times I've been working with human subjects or research integrity or responsible conduct of research, any of the ethics see people and been having what I thought was a conversation towards data preservation and sharing. And it turned out that they were having in their head the same conversation but they were talking about privacy and security and anti sharing. And it sounded similar enough that we felt like we were just not quite getting each other, but it's at one point we realized that no we're actually talking about radically different topics. And we need to go back to the beginning of this conversation and and change the revisit the entire structure we've been through so jargon differences if I had a magic wand. The, that's probably the single most difficult thing. That's very interesting. Speaking the same language and yet speaking such a different language. Thank you for that question. Rebecca and thanks so much for that response Nina Steven have you got anything to add to that. Would you like to add anything.  I obviously turn over is just brutal. Right. I'm sure that had the problem with red cap. One of the problems was the person who is our point person on campus that worked with the center at Chapel Hill had left the university so that kind of left our, our people in the office of research scratching their heads going well we know we have access to this but we don't know how to talk to about it and we're really busy. And so again that was an opportunity for the library to sort of step up and say well we can, we can help you with that. The other thing, just to echo Nina's point, all of you are probably well aware that it has its own jargon as well. And so especially when you start getting into research computing, and when you start talking to it people and you start talking to the researchers and you start talking to the other entities on campus there's a lot of translation and wait are we sure we're talking about the same kind of thing moments. So that's definitely a problem everywhere, to be honest. Really interesting. Thank you. Seeing as how we do not have any more questions in the Q amp a. I'm going to go ahead and propose that I just go ahead and turn off the recording on this session with a lot of thanks to our presenters for hanging in there through our technical difficulties and to our amazing attendees for letting us know right away there was an issue and hanging in there and joining us. If you would like to hang around and approach the podium and have a chat with Steven and nine up please feel free to do so. Raise your hand and I'll be happy to turn on your microphone. And with that, I will bid everyone a good rest of your day. Thank you for joining us at CNI and we hope to see you back here soon. Take care everyone. Bye bye.


and and some others and he's gonna talk about jamming with guitars and sense using baseball please Paul go ahead thank you for the introduction Marco hello everyone good morning good evening wherever you are I'm glad to be here I'm Paul I'm a software developer I usually share topics around software development and data with the community today I'll be sharing from one of my hobbies which is music production it's something that I've been dabbling with during the past year or so one of the softwares that I came across and used during that period is miss Pope having used a lot of music production softwares in the past decades I am fascinated by the amount of features this software delivers due to time constraints we won't be covering all of these features but I'm excited to share with you my favorite modules that I often use miss Pope is an open-source modular digital audio workstation for Mac windows and Linux it was started by Ryan Scholliner in 2011 it also has an active discord community Ryan is also there helping answer questions whenever users like me have increase what attracted me to misspoke is the way the user interface is designed as a guitarist like what you can see here we also usually have effects boxes lined up unconnected via cables this experience is silly translates with how this book is designed I can just connect the modules with lines like how I connect like pedal effects with cables like you can what you can see here on the screen there's a signal generator connected to the output module connected by just a line perhaps one of the best ways I can share this with you is through a sequence of demos I'll share how to create a sound using an oscillator I've also have a midi controller right now that I can share with you how to use with misspoke will add some drums to give a steady rhythm to our song and lastly I'll share how to connect an audio input like this guitar so let's start with the first demo how to create a sound so before I open up this spoke let me just discuss the different modules that I will be using for this demo the one that you can see at the bottom is called the output module this just basically routes the audio to your speakers the one right above the splitter it's just fits the audio signal into two mono signals if you have two left and right speakers and then the gain module just based to adjust the volume of the whole setup but the gut here is also an oscillator it generates the audio signal with a specific waveform although it has other features like filter and go and stop but I won't be covering that for me as long as I can select the saw wave square wave and so on that's fine for our purposes and what you can see on the left side is a note sequencer it helps us loop a sequence of notes so basically we can just paint our notes here and we can drive the sound going to the output so let me just open up this phone and share to you a little bit of that let me load a blank canvas so what you can see here is usually the default setup for this phone you have the default set of modules for here open the oscillator so that we can choose what sound we can generate if I connect it here you won't be able to hear the sound yet because we don't have any driver for that sound so what they can add here next is a note sequencer like what you can see in the slide a while ago I'll be connecting this to the oscillator and then once connected I can just draw the notes that I want to play if you can hear you should be able to hear the sound let me just increase the gain so that you'll be able to hear it so I can play different notes with this I can also randomize the length of the pitch to decrease it to 16 so I've created a sort of baseline using the notes you concern and this particular oscillator so let's put that aside for now let's check what's the next setup that we can do with this phone so the next one is adding an external meaning controller so right now what you can see here in the slide I have this Tanuki Studio which is a meaning controller it simulates the keyboard and stuff that you can connect with this phone so you can drive the notes that just paint them as you saw a while ago so before we go to the actual demo let me just run through the modules that are needed we have the MIDI controller to link the hardware input from our MIDI keyboard we also have the R Plus Pro which is a sim so that we can simulate the block stream and then we also have the note looper the note looper is like your traditional looper but if you want to keep playing the set of chord progressions you can use this so that you can just keep on repeating and lastly I'll just show a little bit of scripting because it also enables you to use Python scripting for line coding so that's let me open that let me just check if everything's fine from the calling shot okay let's go back to the demo now I'm going to open the Tanbus again and what I will do here is I'll get the synth where's that car plus drone so that I can simulate the sort of block string and then I'll bring my MIDI controller module and then from the MIDI controller I'm going to choose my nano-p studio and I'm going to play it right now if you can hear you should be able to hear the if I want to use a looper so that I don't keep playing the notes that I'm playing over and over again I'm going to add the note looper and instead of directly putting it there I'm going to put it in between the synth and then the my MIDI controller module so here you can see the movement I'll need to click right here so that the next time I press the notes it will record do this and sometimes if I hit the record and it's not syncing on time I can basically move it within the same module so you want to add an effect using the script thing let's say if adding echo is a little bit of an effect that we can use I can add that using a script here I'll just choose that note and load it as you can see this is a python script I'll just run it but it's not yet connected so it won't be able to apply the echo yet so I'm going to connect it here to our module script module and then when I connect it to the synth it should have nicer to hear and explain the flux string and now we'll add the base that we've created in the first demo so that you have the base and the flux string playing together so what we have now is a MIDI controller using the MIDI nexus we're going to add some moves to our setup so we're going to add the drums to open up the demo I'm going to add two new modules here first which is just a sample player so you have the kick drums the snare the hi-hat and so on and we have the drum sequencer as well so that you know and correct which samples to play on which part of the song or the part of the bar so let me open that again and let me open some of the setup for the setup for stage two so if you can see we have the drum sequencer and then we have the drum player here I'll just turn off the drum sequencer for now so that if I expand the drum player you can see the different samples that I can play so basically I can choose the kick drum the snare and so on but eventually if you want to play the music as a whole bar with a whole four four beat then we would need the drum sequencer to play it accordingly so this zero corresponds to the random zero here in the kick number two here corresponds to the snare and then this number five here corresponds to what's its number part the clap so if I play the drum sequencer you should be able to hear the whole sequence so now we have the drums let's add the bass that we had a while ago or we have the sort of add to the guitar with third parties for calling instrument that you can load in this book so you can use it like a normal amp knobs and then you can use the presets as well but for this case I'll just use perhaps maybe some drive and then for the looper part before I use the looper let's add a little bit of drums so that I know where to come in when I'm playing the looper drums let me add so effected capture record rest of the questions I'm going to