About
Scott Derby
Attorney at law, admitted in Connecticut.
I have spent my career building and running compliance programs in heavily regulated industries, including securities and international banking. Those are fields where the rules are dense, the examiners are real, and nobody gets credit for meaning well.
What that work teaches you is that a compliance program is not a binder. It is a set of habits that a busy staff can actually keep. If a policy only works when everyone has a quiet afternoon, it does not work.
Why health privacy
Patient information is the same discipline pointed at a different regulation. HIPAA asks a practice to do what a bank compliance department does, except the practice is often three people and one of them is also seeing patients all day.
Behavioral health carries an extra layer on top of that. Substance use disorder records sit under their own federal rule, and state law adds more. Small practices are told to follow all of it without being told how.
How I work
Plain English first. If you cannot repeat the answer back to your own staff, I have not finished explaining it.
For a defined project, like a new contract or policy: tell me what you need, and I'll give you a written estimate of the time and cost before any work starts. Nothing is billed beyond it without your OK. No surprise bills.
And a straight answer about whether you need a lawyer at all. Sometimes the honest answer is that you do not, and that is worth hearing from someone who is not billing you for the alternative.
Happy to talk it through first.
A short call costs nothing and usually tells us both whether this is a fit.