564. Cybersecurity and Data Sovereignty

Would you rather read the transcript? Click here. Staying on top of the legal side of things is a huge pain, but we are at a point where keeping up with these digital shifts is just a core part of running a practice. In this episode, I’m walking through the 2026 HIPAA Security Rule updates and what they actually mean for you on a day-to-day basis. We’re moving away from the old “addressable” safeguards into a world where everything is mandatory, from multi-factor authentication to specific 72-hour data recovery rules. I also dig into the concept of data sovereignty, which is really just a fancy way of saying who actually controls your client data, and how to spot red flags in those long terms of service agreements that none of us ever want to read. My goal is to help you build a simple vetting process for your software so you can focus on the clinical work without worrying that your data is leaking into a global AI training model. Main Topics 00:38: The 2026 HIPAA Security Rule update and the end of addressable safeguards 01:12: Mandatory multi-factor authentication (MFA) requirements for all systems 02:20: The 72-hour recovery rule for clinical data and vendor contract obligations 03:25: Updating Business Associate Agreements (BAA) for AI-specific clauses 04:15: Defining data sovereignty vs. data residency and why control matters 07:45: A three-point vetting checklist for clinical software and AI tools 09:12: Red flag phrases to look for in Terms of Service agreements 11:35: Cross-state compliance and the impact of the Delete Act on practice inventory Cool Things Mentioned The Testing Psychologist mastermind groups and business consulting Reverb : the premier AI-powered report-writing platform for testing psychologists Featured Resources TherapyNotes is the leading EHR system for mental health practitioners. I’ve used TherapyNotes for over 10 years, and it just keeps getting better. Use this link and the promo code “testing” to get two free months and try it for yourself! The Testing Psychologist podcast is approved for CEU’s! I’ve partnered with At Health to offer CE credits for podcast episodes! Visit this link to access current and past episodes available for CE credit. You can use code “TTP10” for a discount on ALL the course credits you purchase from At Health! About Dr. Jeremy Sharp I’m a licensed psychologist and Clinical Director at the Colorado Center for Assessment & Counseling , a private practice that I founded in 2009 and have grown to over 20 clinicians. I earned my undergraduate degree in Experimental Psychology from the University of South Carolina before getting my Master’s and PhD in Counseling Psychology from Colorado State University. These days, I specialize in psychological and neuropsychological evaluation with kids and adolescents. As the host of the Testing Psychologist Podcast, I provide private practice consulting for psychologists and other mental health professionals who want to start or grow psychological testing services in their practices. I live in Fort Collins, Colorado with my wife (also a therapist) and two young kids. Ready to grow your testing services? Click below to get on the waitlist! Join the Waitlist

You can listen to 564. Cybersecurity and Data Sovereignty online on Radio and Podcast. Open the player on this page to stream the available audio.

564. Cybersecurity and Data Sovereignty is an episode from The Testing Psychologist Podcast by Dr. Jeremy Sharp: Licensed Psychologist & Private Practice Consultant .

This episode is 49:29 long.

This episode was published on Mar 27, 2026.

Yes. Use the heart button on the episode page to add it to your favorite episodes list.

Yes. This page shows related episodes from The Testing Psychologist Podcast when more episodes are available from the podcast feed.