ABA Impact and Business Challenges with Derreck Ogden and Josh Nelson Part II

ABA on Tap is proud to present Derreck Ogden and Joshua Nelson (Part 2 of 2):

Derreck Ogden, part of the, ABA Impact Team, works with business owners and c-level executives. His work focuses on preventing business disruption. He is highly regarded for his professionalism, courtesy, and trustworthiness, and clients appreciate his cutting-edge knowledge of technology. A testimonial praises his expertise in choosing and adapting computers to meet specific needs. Derreck Ogden is also recognized as the Chief Executive Officer at WOM Technology Management Group. In this role, he draws on his experience to assist businesses. His LinkedIn profile also lists him as part of the ABA Impact Team.

Joshua Nelson is also a member of the ABA Impact Team. He is described as a natural leader, a great speaker, and a valuable asset. Joshua is recognized for his interest and investment in security and technology, particularly in the realm of cybersecurity. One of his stated goals is to empower ABA (Applied Behavior Analysis) entrepreneurs. He contributes his expertise through thought leadership and initiatives like the 2024 Updated Compliance & Accreditation eGuide for ABA Practices. 

Derreck and Josh lend their experiences and content expertise in helping ABA business owners plan and build toward success. Sit back, sip slowly, and always analyze responsibly.

Transcript

SPEAKER_03: 0:11

Welcome to ABA OnTAS, where our goal is to find the best recipe to fruit the smoothest, coldest, and best-tasting ABA or out. I'm Dan Lower with MicroBeal and join us on our journey as we look back into the ingredients to form the best concoction of ABA on tap. In this podcast, we will talk about the history of the ABA fruit, how much to consume to achieve the optimum buzz while not getting too drunk, and the recommended pairings to bring to the table. So without further ado, sit back, relax, and always analyze responsibly.

SPEAKER_05: 1:07

So you're in this position as an ABA owner where none of your SaaS providers are required or liable for your data protection, right? So when I'm talking to a practice management system, it's how can I get to my data? Because I need to make sure I'm making copies of that and then additional copies of that. So I had a conversation actually yesterday with a guy who is dabbling. He's brilliant. He's an engineer, he's in aviation, his wife has an ABA company that's well run. It's in a different state from where they live, and they've got like 40 employees. So that tells me that they've been around for a while. They know what they're doing for 15, the last 15 years or so. They don't even have to be in the same state as their as their clinic. So he's actually working on what I've been saying needs to be the case for the last few years, which is building your own logic and your own database into your existing tools like Microsoft 365. Um, my gap and my knowledge is what exactly those fields are and how exactly that data needs to flow to billing, how it needs to flow to the BCBA and all that stuff. So I am completely out of my depth as far as being the guy who could design that software. Um, but one of the strengths of building your own internal practice management system is that you have access to the data, you have the ability to program your own features into it. Uh, and the most important thing is you have control over redundancy and retention because that platform is very easily replicatable. You can back it up very quickly. You can set up systems where we literally have plans where people are paying us$15 a month to back up their single-user Microsoft 365 system. It's not that expensive, right? So, and that does the backup, the email encryption, the AI auto encryption filters that catch something that should have been encrypted when you know they make a mistake and somebody sends something, it says, wait, this has sensitive information, it we're gonna go ahead and encrypt it, right? So, you know, that's all of that. So this is really inexpensive as far as being able to do that with a Microsoft 365 platform where some of your practice management systems are completely closed off and you can't get to that data. Um, there's a lot of people who have moved from one system to another who still have the old system and still pay for it because they can't get the data out. Yeah, and I think it's unethical. That that's how I look at it. I believe that's an unethical practice on a part of the practice management systems.

SPEAKER_04: 3:45

That is that is really interesting because all of our data, I don't even think we back it up. It's just saved in those practice management systems and never thought about that. Um we're learning. I have one more question, if you don't mind, Mike, because I know I've been stealing a lot of Mike time here. Um what are some other common compliance issues? So we've talked about this term compliance. Um, what are some other common things that you see? So that redundancy is something that I was not even aware of. The 25 year for Pennsylvania, 19 years for California, something I was not aware of, and I certainly should have been. What are some other common compliance issues that you see ABA practitioners or business owners running into?

SPEAKER_05: 4:24

Well, again, they all stem from a lack of organizational strategy. You don't need to sit down and write policies because HIPAA requires them. You need to sit down and write policies because your business's sustainability requires them. Now, when you're writing those policies, you just want to make sure that they're compliant with HIPAA. But one of the biggest things we see is just nobody has policies written down. Um, and this is another weakness of you know, purchasing kind of pre-baked stuff where you know you just kind of hope it's in there. Um, and you know, we ask people the question all the time like, do you have all your policies documented? Yes, yes, we've got that. Okay, where are they? Oh, they're in our employee handbook. Okay, where did that come from? We got it from XYZ or my my boss at my old place, let me use theirs. Okay. So now we need to dig into the actual policies that HIPAA specifically requires, right? And we'll talk about your state and your county and your exact business model, whether you're in home or in school, all that stuff later. But we need to establish, you know, have you written down how passwords are required to be created, updated, uh, reset in your company? Because HIPAA requires that you have a password policy. Uh, have you written down how you are going to protect data in your company? So the stuff that's moving and the stuff that's just sitting there. So it's data in motion, data at rest. How are you protecting that? And that's your encryption policy. You want to encrypt it, scramble it up so that nobody can use it unless you authorize them to, uh, and then make sure that when it's sitting, it's encrypted and when it's moving, it's encrypted. And this is how important like that one policy is. If you have a data breach and somebody steals all your information out of Microsoft 365, or that you lose your laptop at the airport, right? And you have everything on your laptop. If you have that laptop encrypted, you don't even have to report it. If there's anything on there, and if you but you have to be able to prove that you had it encrypted, you have to be able to prove that it's been encrypted for you know, you have to have evidence to show that we don't need to report this because it is encrypted, and here is my proof of that, right? So that's really the difficult part of the compliance strategy, but again, it all comes from your organizational strategy, and you know, we can get the call, and this is kind of the uh the same line of evolution from us being in IT to really diving into the ABA side to really just a matter of me just kind of getting really irritated because I've seen people in my family and my friends struggle to find care. And I'm like, it's 2018, why the hell is this so hard? Um, and like kind of digging into it, and then it just becoming an obsession uh where I want to figure out what these problems are and start solving them and breaking them down. But you know, along those same lines, we would have uh one of our one of our prospective clients or a client would call us up and say, Hey, I need a firewall. Okay, what kind of company are you? Well, we're an ABA company. All right, do you do clinic based or you know? Well, we're clinic based. Okay. What why do you need the firewall? I don't know. My brother-in-law is in IT, he works with the Air Force or something, and he said, I really need to have a firewall for my security. Like, okay, what is the firewall supposed to do? Can I see your network security policy? Like, oh, I don't have one, we really don't. I mean, this isn't this isn't an area that I really know anything about. Like, okay, that's fine. Um, do you have your, you know, your your other policies that lead up to that? Do you have any policies, right? And usually it's no. And and those policies are what's coming out of your organizational strategy development, right? That's where the that's the source of those policies, not going into HIPAA reading the list and then creating policies to check off boxes. Like these are things you actually need to use in your business. So where most of the customers that were coming to us, or most of the prospects that were coming to us, were asking us for things that they weren't even close to being ready for. And I feel like this is where um the consulting field kind of gets uh a bad rap. Um, because when somebody hires a consultant and says, Here, come in and do this thing for me, if I'm the IT guy and they say, Hey, I need a firewall, a lot of IT companies will just say, Oh, that's great. Let me grab you our list of firewalls and our pricing and let's sell you a firewall. I'm gonna send you the paperwork, you send me the money, and poof, we got a magic purple box sitting on your top, it does nothing, right? So it's not gonna do anything for you, it's not gonna help you, but it's gonna put money in my pocket. So let's get rolling, right? So that approach from all different angles of consulting is kind of the problem where if you don't have that first principles reason for why you actually need that firewall, if you don't have a gap that you've identified in your business that that thingy, that shiny object is actually going to fill for you, then I'm not gonna get it. I'm not gonna, I'm not gonna get it for you. You can call another IT guy, you can do whatever, but like we need to figure out what your actual strategy is here. And that 15-minute conversation turns into another hour-long call where I'm meeting with the owner and saying, All right, let's let's sit down and figure out what your mission statement is, what your vision statement is, let's build out what your financial viability is here. Let's get those six numbers that matter to every ABA company and start building out their strategy. Where the firewall is like we're a year from even having that conversation. And then now we're having this call. So once that started to happen between 25 and 30 times a week, where we're just doing the strategy calls, that's where our course came from. So we're not parroting the same thing over and over again. But all those policies, getting back to what you asked, you know, I can talk about this all day, but the um the source of your policies, the source of your procedures should be coming out of your internal organizational strategy. First, your mission, your vision, your primary aim, your strategic objective, then structuring the business, deciding how you're going to have everything divided up, and then identifying those processes, the first of which being your process to develop your systems and building them. Um, so when you get to compliance, when you get to network security, those types of those types of policies should just flow right out of your chat GPT that you've been training this whole time. It's that simple.

SPEAKER_01: 11:00

So you uh you're alluding to some of these things. Uh we can people can remain nameless to to protect the innocent, but I'm sure you've you guys have pulled people out of some really sticky situations or some horror stories you've seen out there. Can you talk about some of those? Just things that you've walked into where it's like, wow, you guys are in trouble. This is what we can do to help.

SPEAKER_00: 11:19

Yeah, there were there were there were actually two things recently that happened. Um, you know, Derek always has this thing that he says because um there like there there's there's a common theme as a business owner that you'll see is you are responsible. The software company say you're responsible. Like as a business owner, you're responsible for everything. Um and there are three people that'll get you that'll cause you to go broke or get you thrown in jail. And it's your IT IT guy, your CPA, and your uh your attorney. Um and so recently, you know, we actually took over the IT for an ABA company, and they were selling him like$10,000 worth of things that he didn't need. And all he needed to replace those things was his Microsoft 365 that he was already paying for. They wanted to sell him a server and all the all these things that he didn't need. So we go in there and we're like, you know, you you actually don't need any of this. And so he's paying us a fraction of what that that was and all of that. So, you know, an IT guy will will go sell you a magic a magic box like Derek was talking about, and it's not really based on any policy or any actual requirement. The other thing that I just this is recently happened. Um I had a I had a a family friend that uh has a uh has a a tutoring service and they wanna they want to add ABA services into what they're doing because they do special education, but it's not quite ABA, it's not exactly HIPAA, it's just like they they go into the schools and they provide tutoring services. So they hire a an a BCBA um and their corporate attorney advised them that as long as they're not accepting Medicaid or private insurance, and that it's just like based on scholarships and private pay or like like uh you know out of pocket pay, um they don't have to be HIPAA compliant. And so, like yeah, so so there are certain things where like you know, I I would imagine that being an attorney is kind of like being in the medical field, like it's such a broad uh you know, uh general area, like you know, to say I'm in the medical field is like, well, what part? Yeah, because you wouldn't go to a brain surgeon if you need heart surgery, like you're gonna go to a heart surgeon. So, like, um you know, I I basically told this person, I'm like, you know, don't take that advice because like that's gonna get you uh fined or put in jail. Because like the reasoning for HIPAA compliance is privacy and portability. Like if you're accepting any kind of information um that has to do with like a like a healthcare or medical treatment or therapy, uh you're you're responsible to protect it and also make it portable so that that client can take that client or patient can take that information to another provider because they have a right to those those those um uh those those uh records. Yeah.

SPEAKER_05: 14:04

So did you do you guys want to hear my FBI story?

SPEAKER_00: 14:07

Of course, of course.

SPEAKER_05: 14:09

You start with FBI, absolutely. So uh November 2023, we have a uh an ABA company that had come to us and we had done just a basic assessment for them. We had made some recommendations, and you know, budget was tight, they were having difficulties, they had a pre-existing billing issue that had driven them into a relationship with a consultant. That consultant went uh beyond their operational consulting and kind of stepped over their uh stepped out of their lane and um needed that needed some financing, needed some fast cash. So they went and got an MCA loan uh for this company. So now they've got even more financial pressure. And by the time we come in, they've got you know three locations, like 60, 70 employees. It's a I mean dumpster fire. I mean, that's that's really like the only term for it. Um what's an MCA loan? Uh okay.

SPEAKER_04: 15:06

Oh, sorry. Didn't mean anything.

SPEAKER_05: 15:07

MCA loans. I well, I'm glad you asked because this is like another topic that I constantly harp on. MCA loans are hard money loans where you can get all kinds of cash in your bank account tomorrow, and then they have the ability to auto-deduct on a weekly basis. It's basically the payday loan scam for businesses. Um they'll tell you there's zero percent interest or whatever, but they're charging you outlandish fees. So you'll you'll borrow 100 grand and you'll have to pay back 150 grand in a year. Uh well, always take away from MCA loans. Uh, you're better off putting on a credit card. Okay. So um, so they had gotten wrapped up in MCA loan because this operations person had stepped over the line and and uh got them into an area they shouldn't have gotten into. So we're kind of learning all this and doing the assessment and kind of showing them like this is what you need to be doing. Here's your plan of action milestones. And it was all right, we'll we'll get to this like when we get past the money thing. And uh they decided they were going to change practice management systems. And of course, we don't know this. We do the assessment, we help them with a few things, and then we're out until they get past their financial struggles, and then uh we're just kind of on the back burner at that point until the Monday before Thanksgiving 2023. Our help desk gets a phone call and it's from the owner of the company, and they're in the process of moving, and the practice management systems had nothing to do with it, but just for uh the story's sake, they're moving from Rethink to Central Reach.

SPEAKER_04: 16:39

Okay.

SPEAKER_05: 16:40

So this person had a list of all of the users for Central Reach, all the users for Rethink, had them all in nice organized spreadsheets with their passwords and their usernames and all that stuff. They had all kinds of data that she was going through and downloading from Rethink so that she can upload it to Central Reach. So she had massive amounts of data. And because she only had a desktop computer at work, she was using her personal laptop while she was on her vacation or holiday for uh Thanksgiving. So she gets an email from her lawyer, and this is again how your lawyer can kill your business. She gets an email from her lawyer, and the email has her case number for her pending divorce. Um, or maybe the divorce is already finalized, but it was a motion for contempt of court uh because her former partner was not paying alimony. So it's right down to what is actually going on in her case with this lawyer. It has her case number on it, and it's coming from the lawyer's inbox with a PDF attached for her review. So she's trying to run this PDF and it won't open, of course, because it's not really a PDF. It's just a link that does basically what we do when we do a penetration test, it just downloads everything off of her computer and uploads it to the bad guy. The next thing was that it had a OneDrive link built into it. So it's saying this file is being shared to you for your review from your lawyer. It has a OneDrive link there. So she is the admin of her Microsoft 365. She has access to do whatever she wants, which is a whole separate issue, but she's logging in, trying to download this file from OneDrive now. So she's putting in her Microsoft password and her username, right? She can't open it, so she forwards the email to her business partner and says, I can't get this file to open. So the other business partner now is opening it on her personal laptop because she's on vacay, right? Um, they get her email, they get her credentials. So we don't really hear anything from them until uh Tuesday. So Tuesday or Wednesday. So that happened like Sunday, Monday-ish. And then we hear about it on Wednesday. And the way we hear about it is hey, we had a bunch of emails that are going out, and we didn't authorize them. There's people who don't actually work for our company, like the names don't make any sense, but they're all coming from our domain. And uh, we get in there, and thousands of emails have gone out and been delivered, turned into a pretty major situation because we have to contain it. Um, and then we have to bring in a team to ensure that the bad guys are out of the system. Um, takes a special qualified person to be able to go in and do that, depending on the platform, depending on the nature of the breach.

SPEAKER_04: 19:32

Wow.

SPEAKER_05: 19:33

Um, and then we need to get cleared, right?

SPEAKER_04: 19:37

What do you mean you have to get cleared?

SPEAKER_05: 19:39

We have to get cleared to reopen. We have to have somebody with with some expertise to tell us, like, okay, it's safe to go back in.

SPEAKER_04: 19:46

Okay, okay.

SPEAKER_05: 19:47

Um, and you know, I'm not the guy to do that, but we have people who do it. If you're in Google, it's gonna be one guy. If you're in Microsoft, it's gonna be a different guy, right? So, or a different team.

SPEAKER_00: 19:56

So to be clear, they they're like data forensics people that can kind of track down like how the bad guy got in, what information was stolen. Um, and then there's like another expert that needs to go in and basically like make sure it's all locked down again, and then they report back to us and like let us know, like, all right, we we know how they got in, we know whose information was leaked, and it's been taken care of. Wow. Now you're safe to go back in. So, yeah, it's it's a pretty complex thing.

SPEAKER_04: 20:21

Well, it sounds like because I know like out here there have been medical hacks and things like that where people have actually paid ransoms and stuff like that. But go ahead.

SPEAKER_05: 20:28

That's yeah, and and and that's what I mean. That happens a lot. I think uh ransomware is there's been nine, eight or nine trillion dollars in ransomware collected over the last 15 or so years. So if they started their own country, they'd be the third richest country on the planet. Oh my god. US, US, China, and then ransomware.

SPEAKER_00: 20:49

Yeah, back in my hometown in Ohio, Kettery Health just got got ransomware. And and but luckily they had backups, so they didn't have to pay it. But like they were locked down out of their phone system, out of their practice management system, they were on paper, paper data for um for like for like two weeks. Wow.

SPEAKER_04: 21:07

So the here scripts, uh, which actually is the medical system I use, it's a huge one in San Diego. They got ransomware to the fact that they got locked out of their own system. So surgeries, everyone's medical records, they were taking credit card, like it was locked out, and this is a huge medical system. But anyway, sorry, I digress. I was literally on the edge of my seat. I had to adjust myself. Can you please get back to your uh the story about so you got cleared?

SPEAKER_05: 21:31

Or yeah, yeah, and now now we're well no, we never got to that point because we've got to we've got to bring in a contractor who is gonna cost these people about 50 grand to pay this other company to come in and clear us to go back in and open it up. And the the owner of the company was basically like, Well, listen, like we're$750,000 in the hole right now from our billing issue. We're not able to make payroll, right? We're we're we've got this MCA loan now that is at this point about three months old. So they've got these massive weekly payments going out to the MCA. And she goes, What are my alternatives? And I said, Well, basically, you can do the legal thing or the illegal thing. And she said, Well, oh, and this is what they did. So the the this email originated from their family attorney, right? And when the email went to her, it came from his office. His office was hacked, right? Oh man. So she calls him back and says, Hey, I've got this IT guy, the cybersecurity guy is telling me I gotta do this whole response that you need to do your response. It's gonna be like 50 grand on my end, you need to do one too, and whatever. You know what the lawyer said?

unknown: 22:46

Uh-uh.

SPEAKER_05: 22:47

You don't have to do any of that stuff. We don't have to do any of that, we don't need to do any of that. Just just move on with your life, right? And this lawyer, when they when they when he said this, when I saw the email that he had sent, um, because she's showing me, like, hey, listen, I'm I've got you know my lawyer here telling me not to mess with this. I'm like, this is a divorce lawyer, this is not a data security lawyer, right? Um, but when um, but they decided, like, hey, listen, we're just gonna kind of sweep it under the rug and move on. They did send out emails to everybody that they knew had gotten an email saying, hey, don't click on this. Um, and then I'd said, well, listen, we have to file reports with the OCR, we have to file a report with IC3, like we have to put these reports in place where at least you're not like covering it up, right? Which that's a felony. Failure to report a felony is a felony. And I forget what the guy's name is, but a former CIO of Uber um just got five years probation a couple years ago for not reporting the same kind of a breach at Uber, right? And they kind of made an example out of them, but like this is something where you're gonna have this falling around, following you around for the rest of your life. Um, so I said we have to file a report on OCR, uh the Office of Civil Rights for your HIPAA stuff. We have to file the reports also with the Florida Um Department of Health, and then we need to file the report with law enforcement, which would be the FBI IC3 division. So we're in, we work with the FBI. Um, so we're part of InfraGuard, which is kind of a rare thing for IT companies to be involved in, but we're kind of the feedback from the private sector to kind of help them with what's going on, like you know, boots on the boots on the ground. So we submitted it, um, it went through their channels. And usually, if you're gonna submit any kind of crime, like if you're in San Diego, California, if you submit something to the FBI for like, I just got ripped off for$500,000, you're gonna submit the report online and no agent's ever even gonna see that, right? There's not a law enforcement person that's ever gonna put their eyes on that report, most likely. If you file a report that says, um, I've had three million dollars stolen from me, then it's gonna get cycled through and somebody's gonna look at it. That doesn't mean they're gonna call you or investigate or do anything like that. Um, but there are certain red flags, like if PHI was exposed, or if you know it's actively exposed, or if you don't send a you know forensic report with it saying these are the findings, or uh, you know, explain what you're gonna do to you know have a proper response, then those are the things that start to develop into an investigation. Um, so we didn't hear anything back until I get a phone call on my cell phone. Um, and the uh the gentleman says, Hi, this is uh agent Travis Jones from the FBI West Palm Beach Field Office. And I said, Oh, how are you, Mr. Jones? Agent Jones, nice to meet you. And um, and I and he says, I'm at your office and I'd like to meet with you. I'm like, okay. So I'm running errands, I'm being CEO when you know 10, 20% of my time. So I'm in flip-flops driving around in my 1985 Jeep scrambler, like I'm not prepared for a meeting with the FBI. Um, but uh I immediately, of course, like, okay, I'll meet you at our head headquarters. They were there waiting for me. Um, and you know, basically what he wants to know is who what, when, where, and why, right? Like you have to explain everything to me. So when the FBI walked into the office, I basically said, Listen, I like we always participate, we're in InfraGuard, we work with the FBI all the time. But this client contracted us to do work for them. We have a non-disclosure agreement. I can't tell you anything without their consent, right? So he said, No problem, wait here. Don't leave. And then he went over to their facility, had them sign a consent form, uh, basically giving me permission to do it, and then came back. And we, you know, went through all the stuff, you know, download all the reports from you know what we had, uh, which was limited because we're not, you know, in the DFIR business, but we did have, you know, some information that we had found and screenshots that we had taken, and you know, the the statements that we had made, we had evidence for that, right? And um the way it all turned out is I don't know. It's still an ongoing thing. Um, the victim pool from the down, the downstream victim pool, they call it. So from all the people that got emails that that they had sent out uh after they got hacked, that's all still kind of active. Um, since then, now that I have a now that I have a an agent that I can talk to all the time in combination with our Infragard thing. I talk to Agent Jones all the time about stuff, but it's you know, I can't really ask anything about the case or the investigation. But you know, this is a business that's already in trouble. This is a business that's already going down a road where you know one bad decision leads to another. Um, I know that they have reduced from three locations down to one. It's in turmoil. I mean, it's just it's just a bad situation, but it all comes back to organizational strategy. Yeah, they would not have been reliant on that consultant to fix those problems in the first place. They would have understood that their billing was in trouble before it got to be a$750,000 problem, right? They would have caught it when it was a$50,000 problem. Like it's knowing these things, and every single one of their issues came from the fact that it was that they just didn't have any organizational strategy. That's what it's all about.

SPEAKER_01: 28:27

Wow. Wow. What a mess. That that's uh that's a nightmare. That's a nightmare.

SPEAKER_05: 28:31

Yeah, and there's likely jail time involved with a situation like that.

SPEAKER_04: 28:37

Um it you bring up billing, which is interesting because um I have a lot of, I feel like it's uh six degrees of Kevin Spacey out out here in California, because I've trained so many people, I've I'm pretty integrated, at least into the Southern California ABA realm. So when we decided it was time to open up our company, um, I had a lot of people that I could reach out to and a lot of good relationships and a lot of people who shared really uh useful things that were very beneficial in opening up a company. And and the billing one was interesting because there were more than one uh there was more than one person who started their own company that was like, yeah, I started and I provided services and I was billing and I didn't get paid for like six months because I didn't realize I was doing it wrong. And then like, you know, as unfortunately, knock on wood. Um, we haven't run into that issue, but you just keep bringing that up about 750k of bag billing for that one situation, and that seems to be something that's very prevalent.

SPEAKER_05: 29:35

Yeah, and it's something uh our our outreach team talks to several hundred companies every week, and out of those companies, you know, the ones that have started within a year, well, the the ones that have given up within their first year of business is somewhere around 40 or 50 of them. So you you talk to a few hundred, and there's a few dozen in there that are um that are just giving up, and and the biggest. Thing is the number one reason is cash flow. It's a dead stop, you can't get past it, you're not prepared for it, and the only cure is a time machine, right? Sure. Um, so like you're in that position for reasons that you can't change once you're in the position. So um that's kind of a major thing. And then the other one is just general burnout. I had that conversation on Easter Sunday. I'm, you know, we often get you know direct messages on Facebook, and I'm terrible at keeping up with them. So if you need to get a hold of me, send me an email. Don't message me on Facebook. But this one day I was actually paying attention and um got the alert. And the the question was, I I have a ABA company, I want to sell it. I said, Okay, just tell me a little bit about your company. She starts getting into the financial stuff, and um uh I can't remember how many employees she had, but she was doing a little over four million dollars a year in revenue, and uh she was running a 34% margin. Impressive and and I asked her like three times. I'm like, is that your net profit? Yes, thirty, thirty-four, thirty, thirty-three point something, basically thirty-four.

SPEAKER_06: 31:14

Okay.

SPEAKER_05: 31:14

I'm like, okay, um tell me why you want to sell. Well, I I hate my life. This is a disaster. This business is taking everything over. I'm getting some certification and the uh the organizational behavior, um, or the behavior, LBM, yeah, the organizational stuff, right? She's like, I'm getting this certification that getting out of this. And then you know, she's starting to describe the the reasons that are the the her business is you know driving her into the grave. And um, and I said, Well, these are all things that you're gonna have to fix before you sell the business, right? Like you might have EBITA that's there and you have a good profit margin, but if somebody has to sell their soul to own the business, like this is not something that's gonna be uh very appealing to uh a you know a small business owner. Yeah, and she said, All right, well, what am I gonna need to get done? Like, what do I need to do? And I said, Well, basically just pretend that you're starting up a new business. Start from the beginning, build it from scratch, and then start transitioning your business model into that new business model that you've built based on what your actual goals are and everything. And then her next question was Have you ever heard of somebody just giving their company to someone else? Oh, wow, where he doesn't want to even sell it at this point, like she wants out so badly, like her life has been like she's she's been so abused by her own company that that she just wants out and she doesn't care how I think that happened with our last company, actually, but go ahead. Yeah, and and then and this is more common than people think, and I think it just has to do with a lot of the misconceptions and the the the misguided reasoning for getting into the business. Um, I think I was able to stop that from happening in one example where we were on a call with a nice lady in uh up in the northeast United States, and she's a BCBA, and she said, I want to start my own company. I just want to talk to you guys before I do this. I want to do the free foundation course and kind of start getting my ducks in a row. And I said, Okay, my first question is always, why do you want to start your own ABA company? And uh she said, Well, when I'm billing out for what whichever the CPT code was that she had mentioned, she's like, I know that that's the code that I bill the most most of. And when I bill it, I'm getting paid about$50 to$52 an hour for my time. And she goes, but I also happen to know that the company is getting paid$90 to$95 for that same unit. And she goes, So I figured I'll just start my own company and then I'll be able to keep the$95 instead of the$52. And I said, That is great logic, like it makes sense on the surface, right? Like you just broke it down, but we need to go a few layers deeper. We need to get down to first principles, right? So, and and we in about 10 minutes figured out that she was gonna end up keeping about$35 of that 95 after all of her overhead running it on our own. And I said, listen, you want to make$150,000 a year. That's great. This is how you do it, right? Then we we're just kind of running through a couple simulations. You're gonna need, you know, between 18 and 21 RVTs out on the road, you're gonna have to have this many billable hours every month. You want to keep it below this many so that you're not, you know, burning out your employees. This is how much backup staff you're gonna need to support that frontline. And she said, There is no way in hell I'm gonna start a business and run a company with 25 people. I don't want to do that. Like, I'm not ready for that. I don't want to do that. I have no desire for it. And I said, Yes, ma'am, thank you. Have a nice day. That's it. Like, that's all you needed to know. Like, we just stopped that phone call five years from now where they're just saying, I just want out. Like, this is awful. Like, my life is out, right? Um, but you know, I also I also told her, I'm like, give it a few years, you know, you might think differently about it, right? And take it slow. And you know, business ownership is not for everybody, but uh, even if it is for you, you still have to do it right, or it will become uh it will become a nightmare.

SPEAKER_04: 35:23

Yeah, yeah, I I agree. And I think that's the the cool thing with with us and our company is that we are all very aligned clinically, and that's the the biggest thing that um you know brought us together is we were just really dissatisfied with the way that ABA was being practiced. That's honestly why we started the podcast is because there's that huge anti-ABA movement, and we just wanted to delve into is it the field, is it the way that it's practiced, or is it people that are misunderstanding? And then years of doing this podcast, we were like, wow, we're kind of the places that we're working are the people that we're complaining about on the podcast. And we've been uh, you know, multiple, and we actually honestly, you you mentioned the 34% margin. For many years, we worked together um at a company that might have had the best rate. I would the bet we had a capitated contract that probably had the best rates in the country. Um and we were able to offer guaranteed hours to all of our staff, and it was and and capitated was because it was a psychiatric company. Um, we basically got paid on the front end. It wasn't a fee-for-service model. And it was just amazing, but we did it ethically and we kept our hours low. Um and we just had this really idyllic situation, and then from there, our parent company really messed that up. You talk about billing and and data, it's it's very uh very interesting. They messed that up. We got sold to another company that sold to another company that basically just gave us away for free. Um and we just got this indoctrination into the real ABA world and kind of what it's like. And we were like, well, we just I think we need to start our own company if we want it to be like we want it to be, because values aren't don't seem to be aligned with any of the corporate ABA structures that we're working for and we're hearing about in the actual like direct service delivery field. I don't know if that was even really relevant to anything, but you made me think about it when you were talking about the values and not just doing it for the money.

SPEAKER_00: 37:21

So we so we we've we've done um nearly 1,500 orientations through the uh through the Facebook group where we've basically like with ABA owners or business leaders or people who are thinking about starting their ABA business, we get on a call with them, just kind of ask them like what are what challenges are you facing? Um and uh one of the common things that I hear about like why they want to start their business is exactly what you said. Like they want to do ABA their way, um, because wherever they were working, uh they they they didn't agree with it. Um so that that it's so what you said is really common. And then the billing thing is like a really common challenge that we hear too. So it's it's like it's like you know, the the the way that ABA is done, uh billing and uh and staffing and recruiting is like the the kind of and marketing like are kind of like the top things that I hear uh when when I'm asking, like, hey, what are you struggling with? And then they they that's how that's how we've gathered this information.

SPEAKER_04: 38:14

Yeah, that's um I want to come back to something you actually said um earlier. You said the the six metrics I I might but trade her a little bit. Uh you said it kind of in passing very quickly. Um, but you said the six metrics of ABA fiscal success or something like that, Derek.

SPEAKER_05: 38:31

Oh yeah, so uh so we don't we don't get that deep. Don't expect me to get uh get into your uh your your hype your financial analysis here, but but what are those so when we're talking about um there's a part of the foundation course that's called the financial hypothesis, right? Okay, so this is your educated guess. This is where and this is where it's free. We want people to get in and do this course when they're thinking about starting a company because it stops things like they're getting 95, I'm getting 55, I want the whole 95. It cuts that logic out because we go through a little bit of the financial logic. So six numbers. One comes, I'm gonna try to remember all these off the top of my head. One comes from your primary aim. So we develop your mission, your vision, your primary aim. Your primary aim is all about you, the business owner. And if you have partners, everybody needs to write their own primary aim and then come together so everybody knows the others. That way we know what all the inputs and outputs are on each partner's part, right? One partner might say, I want to invest a half a million dollars and not work. The other partners need to know that. And they also need to know that they expect a 10% return in two years. Like this is important information to talk about, right? So this is the primary aim part. So your personal income on an annual basis is part of your primary aim. So that's the first number in the financial hypothesis. Um, I'll see if I remember the rest of them. Your lowest payer for 97153, whatever your worst case scenario is, there, your highest cost hourly for your uh frontline employees. So whatever you're gonna have to pay a frontline RBT at the most, plus 25%, right? Um, and the difference between those two numbers is what we use to kind of calculate how many hours you're gonna need to build for. Because we want worst case scenario. We don't want, you know, it like rather than spending uh two weeks pulling together all the numbers and figuring out averages and doing all these complex calculations, let's grab this in 45 minutes, run it through a quick calculator process in our chat GPT engine that we're building, and let it spit the numbers back out through to you and run through some you know hypothetical scenarios. So our average our so what we want to make, how much we're gonna get paid, how much we're gonna have to pay out to get paid that at the most, um, how much our frontline employees are gonna cost us on a monthly basis with their fixed cost, uh, and then a few others, right? So this is basically just picking out these, you know, five, six different numbers that you're gonna need to figure out how many employees am I gonna have to have on the road? Uh, what is my life gonna look like? How am I gonna have to support that? Because you know, when that foundation course wraps up, you kind of have an idea of how big your company is going to need to be for you to get out of it what you want out of it. And you're gonna have these kind of foundational statements made. That's why we call it foundation, right? So you're gonna have all of that, and then the next step is to get into the structure course, right? So actually structuring the business how it needs to be to achieve the strategic objective that you're aiming at from the previous course. So you mentioned before, like you couldn't really find a corporate structure that matched with your values, and I've heard that exact statement umpteen times, right? So, and that's valid. But the question is, does it match with your structure now? And usually people say, Yeah, you know, pretty close, like, okay, can you tell me what your structure is? And then everything falls apart because the structure's in their mind, they kind of have this idea of you know how things kind of should flow, but really all of the know-how in the business, all the logic is in a few one person's head, or best case scenario, a few people's heads, those rock star employees that you have out there, and that's the problem. Like, show me on paper how your structure aligns with your values. You've shown me what your values are, now show me your structure. And really, it's simple. If anybody's watching this, these are exercises that you can do on your own. You know, you can you can take any of the big private equity companies or any company on the Fortune 500, right? Just pick you know, General Electric or DuPont, any of these companies, and you look at their org chart. All of the roles that are in your business exist for one purpose and one purpose alone. The only first principles justification for a role to exist is to be accountable for and have ownership of. Earlier I was saying ownership isn't all about stock, you know, a stock in the company. Having ownership of a process, meaning you're you have a medical billing process and there's SOPs and checklists and KPIs that are built into that process once it's properly documented. Well, now somebody needs to be responsible for it. And it's a role, it's not a person, it's just a role. And that role is your medical billing specialist, right? That only reason your medical billing specialist exists or needs to exist in your organization is because the medical billing process exists, right? So that's where your roles come from. Also, the that second row of your org chart, the vice president of this or the director of that, or chief chief whatever officer, right? Those are your functional areas. So what are the functional areas of your business that you need to cover? And that's where you start in structure, right? Building out, you know, we finance, marketing, uh, clinical operations, clinical model and outcome, right? Dividing the business up into that. And that's what we do in structure, and then we break those up into processes. And then in systems, each of those processes starts to get developed out, uh, and you have this kind of constant evolutionary loop where everything is always getting updated. And I think that goes back to what you were asking about with, you know, like kind of what does that mean? Like, how do you do it? Um, or you know, what are the specific examples? You know, if you've already decided how you're going to handle something on a Saturday morning, six months before you started running your company, uh, and your bathrobe and your slippers, and you're just on your laptop at your kitchen table drinking a cup of coffee. There's nothing crazy going on in your life, you're not distracted, you're not emotional, you're just putting down this is the way things should be. You've already decided how you're going to do things in that state. That's the best state to make those decisions in. So go through your functional areas, structure the business, decide how you're going to do things in that state of mind. Because once the bad thing or the problem already happens, once that impact is already coming through from that risk, it's too late to do a good job, right? You can do an okay job, you can survive it, but it's too late to handle the problem because it's already here. Um, so that bad Apple employee that's spreading rumors or gossiping or just, you know, polluting your company culture, or that rock star employee who's about to leave. Yeah, when they walk out the door, you should have already on a Saturday morning, years ago, established how that whole process is going to work. And you know what? Your next step when that happens is to give the person a hug, congratulate them, and say, All right, what is the last day of work? That's your last day of work. We need to make sure that everybody knows we're all meeting at Chili's or wherever for your going away party. Like that's how things should work when your rock star employee leaves. And it happens. We had uh a kind of a uh major discussion a couple of weeks ago in the Odyssey was somebody made the statement that um happy employees don't leave. When in fact they do. And I actually have an example of that in the foundation course where we changed the name of the person, but it's kind of about uh it's about a scenario that I helped someone deal with where Michael owns an ABA company, Judy is his clinical director, and she's just she's awesome, right? And she handles a lot of stuff, but all the systems are in her head, and they were family, um, still are, and she worked for him for almost 15 years. And the problem happened that Judy is a single mom. Uh, her son graduates from high school, and they're in Texas working for Michael at his ABA company, and she's just a rock star employee, right? And never had a reason to leave, never had an argument. Thanksgiving's Christmases together. I mean, they were tight. Uh, but when Judy's son gets accepted to the Air Force Academy in Colorado Springs, she's gone. She's gone. And, you know, 60% of Michael's systems for his business walk right out the door with her, even giving a month notice, even having the little go-away party, and everything's gonna be fine. And things continue to operate, like nothing fell apart, nobody really got hurt except for Michael, because now he's in, you know, he he he's now going from a you know, 50, 60 hour work week to like he's not going home on the on the weekend, right? Like he's he's gonna be there all weekend catching up, and he's gonna take some hits in his pocketbook on the billing side because she was overseeing that. Um, and that is the structure loop, those recurring problems that keep coming up. Every time something happens, the impact is high. The likelihood of those happen happenings remain high. The business isn't making any progress forward. You feel like you're just surviving this circumstance and you're getting through it again. And I believe it's a it's a misconception to say, you know, this is business ownership. This is how it is. Like, just deal with it because it sucks about 95% of the time, right? Like you're it's tough, right? Yeah, you've got all these responsibilities now. It's like being an adult on a 10x level, right? Like it's because you're because you're adulting for a bunch of other adults, also, right? Um, and and it's hard, but it does not have to be a dumpster fire, it doesn't have to take over your entire life. It's supposed to be difficult, it's supposed to be a struggle. That's why so many people don't do it. Um, but you can build it in a way that it's manageable, that you will still like your life, that people will still like you. You can do an excellent job at clinical care at scale, uh, and you can be consistent at scale. Yeah, I truly believe I've seen it happen.

SPEAKER_01: 49:21

And and uh from the very beginning, you were absolutely right. None of this was covered in my uh BCBA program, my certification program. Not one bit. Have you guys been approached by any programs? Have you been able to lend this information kind of in a general uh workshop to uh folks that are about to take their test? I I think that there's it's interesting in our field. You can have 20 years of experience and sort of hit this cap as a BCBA, and then you have somebody that just passed their test and comes in, you know, five grand under you. And I think it's frustrating for people and they don't understand a lot of these things that are feeding into that uh, you know, in into those scales. Uh have you guys been approached by anybody to add this to anybody's coursework or have you offered it to people that are that are going through candidacy?

SPEAKER_05: 50:09

Yeah, and just anybody who's listening to this podcast, if there's something that you think we could contribute to, something that you think you can you could contribute to our community, uh we'll work with anybody. It's it's whatever it takes to move the needle in the industry toward clinical ownership-led industry. Like that's what we're going for. And you know, our goal is to have a thousand people in the Odyssey within three years. Uh, we we don't want it to be a monster group. Uh, we already have one of those. But the Odyssey, what we're trying to get is the top three to five spots on the top 10 most highly rated. And I don't know exactly how we're gonna measure this, but with the top 10 best ABA companies in the country, we want to have three of those five years from now. Well, we want three of those spots to be our Odyssey members. Like that's my goal. And I don't really care how we get there. So if people, you know, anybody who has, you know, some kind of contribution or an idea or something they want to work on, I'll give you an example of this. We've been working on slowly because it's not one of our top priorities, but we wanted to build a tool where people can find the therapists in their area and identify what kind of insurance they take, what kind of uh services they provide. And a lot of people have talked about this. And what we've done to grow our group and and to really build our outreach and build our programs so that number one, people know who we are, and number two, they know what we do. Like from there, everything else kind of falls into place. We've built like kind of a crazy AI system. Like we have a couple of servers in the cloud, we have a full-time person who just does nothing but all of our data management aggregation. It's all AI-based and Python scripts and databases, and it's pretty wild, right? Starts with the MPI, but then enriches it far beyond what information is in the MPI database. But um we I met with a person who is farther down the road of developing a tool to do what we were working on. And we were kind of doing it out of the out of the the rationale was there's a gap here, and we have the data, like we know where where to find these people, like we have the information on where they are. So, how can we make that available to the parents that are looking for them or guardians that are looking for them? So that's kind of the approach that we had come from. Uh, but we're not BCBAs. We don't really know when we talk to somebody when they say, Oh, we've got great clinical quality, like we don't really know that, right? Like we're not in a place to really vet someone. We're not really in a place to vet someone as to whether they know uh the the billing side of it really well. So our vetting process is, you know, we'll do a live stream, we put them in front of 10,000 some odd people, and they can vet them and tell us if they suck, right? So um, you know, that's kind of our process with this, but it's more difficult to do that when we're talking about, you know, uh verifying or validating a certain provider for a guardian to feel more comfortable with them. So this person we talked to has all that figured out. They have the the front end of it figured out. And I said, Well, here, let me show you our site. And she pulled it up and she went, Oh no, you guys are doing the same thing I'm doing. Like we're we're competitors. And I said, Well, maybe we would have been, but not anymore. I said, Because I can tell you right now, I'm the CEO, I can decide what we're gonna do and what we're not gonna do. So we're gonna stop this because you're doing a better job in an area we can't really succeed in. Uh, we'll give you the data. Like, we'll we'll give you the back end, like we'll figure something out. We don't know exactly how we're gonna do it, but I don't want your money, I don't want any of that. We'll just set you up and make sure that you have all the information that you need to connect the right people, right? And she was kind of again, a lot of people are skeptical of us when they first start talking to us because we tell them we'll get on the phone with you, we'll help you do this for free. Like, why? Like, well, we'll show you. We'll show you why. You get on the call, we'll do it for you for free. We'll help you through this problem, we'll talk to you about it. And you know, she was kind of in that skeptical place too, but you know, we'll get past that. But I just want to make it clear that if somebody has something that they're working on and your process maybe works better for a different learning style than ours does. We have coaches that have their own coaching programs that are doing very similar material to ours, they're teaching on our platform, we're teaching on their platform because it's it's different approaches, right? Everybody has their own special way of doing things. And if something, if we're the best fit, great. If another coaching program or another course is the best fit, great. And we don't charge money for that crap. Like if you want to come on and teach a course, just teach the course, right? So we don't charge for going out and teaching elsewhere or doing podcasts or any of that stuff. We just want to help in the best way we can.

SPEAKER_04: 55:03

I love that. What's that? It's a rising tide raises all boats, right? Like that's that's amazing.

SPEAKER_01: 55:09

Well, we really uh like like we mentioned at the start, it was easy for us to talk for two hours. It is it is uh you know breezed by. We truly appreciate uh your ethic, gentlemen, uh and your interest in helping uh BCBAs and helping people in the ABA industry. We agree the uh the services are so necessary to hear about six to eight month waiting lists, to hear about all the pitfalls that uh people are facing, uh somebody like myself that just wants to do the clinical practice, but there's so much behind it that needs to be in order for me to do my best. That's where I appreciate my partner here and all our business partners. And again, everything you're speaking about is so important. Uh we're so glad that you're disseminating the information in the community and that you've taken an interest in in uh ABA so that uh you can help these clinicians that sometimes come in it with little to no business acumen. And again, there's a good intent, but without a strong business model or a strong foundation, as you've discussed, uh it can make it very impossible, it can make it very cumbersome and and challenging. So uh anything else, you guys, uh please, if you want to uh plug websites or anything else that you want to tell people about where to find you uh in case they could use your help if you could provide that information.

SPEAKER_05: 56:22

Absolutely. And and you know, again, the reason that we're here, the reason we're the reason we do our live streams is streams is because people show up to them. The reason we do our Odyssey calls is because people show up and we hammer out problems for two hours, right? Like and the reason we do these courses is because we put one up and 300 people jump in and do the course and it helps them. So, like as long as we can be of assistance and we're doing something that's actually being you know uh helpful, um, you guys are doing what we appreciate is getting done, right? Actually being there to support our uh our community and make our world a better place. So we're just not good at that side of things. So we just want to support you guys and make sure that you have what you need to get out there and get that side of it done. Uh anything you need, uh you can learn all about our program at abaimpact.com. Uh if you have any questions or um but want to you know book a call and talk to us. We're busy, but we have availability on our schedule. So we can get you a booking link and you can pick out a time that works for you. Just drop an email to info at abaimpact.com. Uh, if you want to learn about our IT services and our compliance stuff, that's on uh W O M P C A V dot com. Um, so that's our IT company. But you know, really the biggest thing is making sure that your business is going to be successful. You're covered in all these areas, not just your compliance, not just your your technology. But you know there's a lot of shortcuts you can take by getting with our team and not having to experiment with your business and figure out what works because we've talked to thousands of you guys. We've we've heard the same few dozen problems hundreds of times, and we know kind of the the easy way to get there. So it's not that you know we're we're extremely intelligent, it's just that we have a huge sample size that we've closely inspected. So anything we can do to help you and your your ABA therapy business move forward, we're we're down for the ride. Let's go.

SPEAKER_01: 58:17

We appreciate your time uh today, gentlemen. Uh Mr. Josh Nelson and Mr. Derek Ogden. Thank you. Thank you very much for taking two hours to speak to us. We hope that our listeners uh take advantage of the resources that you offer. I'd like to give a quick any any other closing words, Josh? Anything else you want to add before we uh end today? No, thanks for having us. Well, thank you. Thank you again, Mr. Dan. No, now I forever hold your peace.

SPEAKER_04: 58:41

I really appreciate the time. Thank you, gentlemen, so much. I have a strong feeling that we'll probably be reaching out to you all on outside of the ABA on tap side, just for the company side. That wasn't my expectation. But um, I think we I learned so much and my brain is spinning right now, um, just thinking about things, and then I think that we can help um you know disseminate your message because we are certainly on the same lot wavelengths, but also I think we can learn from you both uh as we venture into the the ABA world company ownership as well.

SPEAKER_01: 59:13

So thank you so much. I really, really, really appreciate it. I'd like to do a quick synopsis here before our tagline and we'll take a a few gems that you guys lent us. So if it's a problem, there's a solution. So find it, apply first principles, and always analyze responsibly. Cheers, gentlemen. Thanks so much.

SPEAKER_02: 59:32

ABA on facts is recorded live and unfiltered. We're done for today. You don't have to go home, but you can't stay here. See you next time.