Business platforms for therapists integrate functions that a therapist needs.
Q: Which business platforms offer the best integration of the functions that a private practice therapist needs?
I can only think of one. The biggest shortcoming of most business platforms made for private practice therapists is that the traditional philosophy of selling time is baked into the features. It is rare to find a platform that gives therapists a custom website, ways to market the practice and ways to generate income from digital products, group programs, online courses and asynchronous coaching behind a login.
In my opinion, offering asynchronous therapy programs is the best way to build a profitable therapy business. In my own business, I designed several Wordpress websites to give me this result. It took me more than 10 years. The technical glitches were endless. I don't recommend this route.
Instead, I highly recommend the AttractWell platform for private practice therapists who want their website, marketing and curriculum to be completely integrated. Zoom, online forms, online appt booking and everything else you need is included.
- Attract Well (attractwell.com)
This is the only platform that I recommend for private practice therapists who want to generate multiple income streams rather than relying on their time as their sole inventory. You can create and grow a business on this platform. My personal link gives you a discount to get started.
Q: Which clinic management platforms are a good fit for Canadian therapists?
Most clinic management platforms are designed for appointment bookings, clinical notes and invoicing. The don't offer a way to create a website, send out marketing campaigns by email, and host curriculum behind a login.
The traditional philosophy of selling your time as your sole inventory makes clinic management platforms too rigid if you want to add asynchronous therapy to your practice. The ones that include video conferencing are designed to mimic a doctor’s visit. They might not offer interactive features like playing videos, sharing audio across devices, and using a whiteboard. The following are popular with Canadian therapists because they offer data storage within Canada.
- Doxy Me (https://doxy.me/en/):This is promoted as a telemedicine solution for clinics, hospitals and health systems.
- Therabyte (https://therabyte.app/): This software was designed for SLPs and OTs. It features client booking, documentation, goal tracking and invoicing. It's a BC company with servers in Canada and the US. The video conferencing feature is called Therabyte Meet.
- Jane App (https://jane.app/): The Jane platform is for healthcare providers like physiotherapists and chiropractors. It offers online booking, charting, scheduling and invoicing in one system. This company is based in BC and has multiple servers in Canada, plus servers in the UK, the US and Australia. They have an internal payment processing capability which works in Canada and many other countries.
- Owlpractice (https://owlpractice.ca): This Canadian platform offers online clinic management for mental health, allied health, SLPs and OTs. The video conferencing solution is called Owl Video Therapy.
- Practice Better (https://practicebetter.io): This platform was designed by a dietician and her husband. It has a number of features specific to the wellness industry and also offers integrations with wellness apps. It offers integration with Zoom rather than providing a lesser video conferencing solution.
The following platforms are hosted on servers outside of Canada. The level of security is high. Many of these have in-app video conferencing or the option of integrating with Zoom as an add-on. Here are some examples:
- Theraplatform (theraplatform.com)
- Thera-link (https://www.thera-link.com)
- TheraNest (https://theranest.com)
- Simple Practice (simplepractice.com)
- VSee (vsee.com)
- Get Healthy (gethealthie.com)
Warnings about the risks of data storage for Canadian therapists can be confusing.
Q: Why have I seen advertisements that tell Canadian therapists to use keep their data in Canada?
There is no federal law requiring therapists to keep their data in Canada. There are a few provinces that require public agencies to keep their data in Canada. (i.e. Alberta, Quebec, British Columbia and Nova Scotia). This doesn't apply to the data you collect in your private practice. Your business is not a public agency.
Personal Health Information Protection Act (PHIPA): In Ontario, all healthcare providers must comply with their provincial Personal Health Information Protection Act. It makes no difference if they are with a public body or a private company. Ontario has many clinicians in private practice, so the advertisements you find online are largely aimed at the Ontario market.
Ontario’s PHIPA states that a company in Canada that outsources information processing to the United States, where it will be subject to US laws, should notify its customers that the information may be made available to the US government or its agencies. The information should only be used for the original purpose of collection. It should be stored with the same level of password protection and encryption as would be the case in Canada.
While information can cross borders, the Canadian business remains liable for any problems if there is a security breach. This risk places a hardship on Ontario’s healthcare providers, making them understandably cautious.
Q: What is a HIPAA Business Associate Agreement?
HIPAA addresses the problems of a fractured healthcare system in the US, where personal health information (PHI) is constantly being passed between healthcare providers, health insurers and health exchange organizations.
HIPAA Business Associate Agreement (BAA): The purpose of the BAA in HIPAA is to ensure that there is an unbroken chain of responsibility for any personal health information (PHI) that may be “touched” by a vendor and/or service provider. In other words, the law forces the big players to meet a common standard. The agreement is a method of sharing the risk and is, essentially, a promise to be accountable should a breach take place.
Not all providers for video conferencing software are willing to share the risk. For example, Apple and Skype have deliberately chosen not to take on these risks.
Q: Do I need the expensive healthcare version of Zoom?
It depends.
Zoom has three features which use cloud storage:
- Storing recordings in the cloud
- Creating user accounts for clients, which requires their name and email
- Texting with clients in the Zoom chat window
As a clinician in Canada, it is your responsibility to understand your obligations and goals. Are you required to keep your data in Canada? Are you running a sole practice? Are you responsible for a large workforce?
If you are required to keep your data in Canada, the free version of Zoom might still be the best option for you. Simply avoid using the chat feature in ZOOM and download your recordings to your computer instead of storing them in the cloud. Use a password and the waiting room feature. This prevents people from entering your session without permission. Your clients won’t need to create accounts. None of their data will be stored in the cloud. Once you have this set up, it works every time.
If you are with an agency or clinic, there is more risk. Your workforce might not be diligent about doing the manual steps that I just mentioned. In that case, you might want a paid account with Zoom, with a signed Business Associate Agreement. Cloud recording will be disabled and encrypted chat will be enabled. User accounts can be deleted. Notice that encrypted chat would still store messages in the cloud so you should avoid the chat feature.
Maintaining clients over time often involves communication within treatment teams.
Q: Is consent assumed in workplace communication, allowing colleagues to discuss a case?
The key concept to remember is that the data belongs to the organization that has collected it. The organization is responsible for maintaining the confidentiality of the information.
Specific levels of consent are assumed in workplace discussions between colleagues. This is tied to the role and responsibilities of the employee. People working within an organization have access to the internal data that is appropriate for their security clearance level. They are allowed to have case discussions with others that have similar roles and responsibilities.
Organizations are required to have safeguards in place so that people who don't have security clearance cannot access the information. Leaving a confidential file on top of a desk overnight would be inappropriate because the cleaning staff would be able to read that file. Similarly, having a case discussion in a public cafeteria or elevator would be inappropriate. Security badges, locked doors and passwords are all examples of safeguards that protect the privacy of clients.
If you don't have my free e-book yet, click on the image for more information.
Q: Should supervisors or students be able to observe telepractice sessions in a clandestine way, without their participation being obvious to the client or clinician?
Sometimes a clandestine observation is better than an interruption which derails the session. Your policy regarding observations should be explained at the beginning. It should be part of the informed consent. ZOOM Cloud Meetings offers this for agency accounts, but not individual accounts.
Q: Can my coworkers see my clinical notes?
Yes, many workplaces use some type of central, secure storage for data so that the data survives long after you are gone. If you retire or move to another job, the information about your past clients will stay with the organization.
Q: My workplace has a VPN which I use when I work from home. What is that?
Here are some definitions that you should know:
Intranet: An intranet is a private LAN accessible only to an organization’s staff. Intranets can act as communication hubs for organizations. If you are an approved employee, you can store information such as clinical records, staff news and announcements centrally and your co-workers will be able to access the information at any time.
Intranet versus Internet: There is one major distinction between an intranet and the Internet: The Internet is an open, public space, while an intranet is designed to be a private space.
Remote Access Server (RAS): A remote access server is a type of server that provides a suite of services to remotely connected users over a network or the Internet. It operates as a central server that connects remote users with an organization's internal local area network (LAN). Thus, an approved employee would be able to log into the private space without being in the building. It allows employees to work remotely.
Virtual Private Network (VPN): A VPN allows you to create a secure connection to another network over the Internet. If you are working for an agency from a remote location, your agency will want to prevent unauthorized people from being able to access the private space. A VPN encrypts everything from end to end and makes it appear as though you are in the same location as the server that you are logging into.
Here are the five guiding principles for Canadian therapists.
1st Principle: The Personal Information Protection and Electronic Documents Act (PIPEPA) applies to all of Canada
As a service provider in Canada, you are required to comply with PIPEDA, which is a federal law that has some similarities to HIPAA in the US. Whenever you obtain personal information about a potential client, you are expected to protect that information with three types of safeguards:
- Administrative safeguards identify all written, spoken or electronic personal information and prevent that information from being shared with people who should not have access to it. For example, a consent form for the release of information is an administrative safeguard.
- Physical safeguards like locked doors and employee badges prevent unauthorized people from being able to access workstations and electronic media.
- Technical safeguards, like user IDs, passwords and data encryption, keep the data hidden until an authorized recipient opens it.
There is no federal law which states that personal information or personal health information must stay on a server in Canada.
If you don't have my free e-book yet, click on the image for more information.
2nd Principle: In most provinces, the privacy protection laws for data collected by the private sector have been deemed as substantially similar to PIPEDA, the federal law.
If you are a therapist working in private practice, you are working in the private sector, not the public sector. Use the link below to get the details for each region of Canada. You will see that in most parts of Canada, the privacy protection laws for the private sector mirror PIPEDA. There is no provincial or regional law which states that the data you collect in your business must stay on a server in Canada. Businesses are permitted to use programs that run on global servers, such as email, online programs and cloud storage.
In the province of British Columbia, the privacy protection law for the private sector is the Personal Information Privacy Act (PIPA). If your business collects personal information from clients and simply bills a government funding source, PIPA applies. For example, if you are a therapist in BC, your data from clients funded by the Autism Funding Program or At Home Medical Benefits can reside on global servers.
3rd Principle: In a few provinces, the privacy protection laws for data collected by the public sector state that the data must stay in Canada.
All Canadian provinces and territories have enacted legislation that regulates the collection, use and disclosure of personal information in the public sector. Specifically, this is any data that the local government has collected through public schools, health authorities, public service agencies, the courts and so on.
Let’s use British Columbia as our example again. BC protects public data with FOIPPA (Freedom of Information and Protection of Privacy Act). Public bodies are required to comply with this law, which states that data collected by a public body must stay in Canada. This has far-reaching implications for the use of email, online programs and cloud storage. Note that this is not a federal law; it is specific to BC.
Nova Scotia, Quebec and Alberta have similar laws. These were enacted in response to the Patriot Act in the US. The following article provides a summary of how and why these provincial laws exist.
4th Principle: The Personal Health Information Protection Act (PHIPA) only applies to healthcare professionals in Ontario
If you do online research regarding practice management software for therapists in Canada, you will find marketing messages aimed at Ontario’s healthcare providers. Ontario has a unique privacy protection law which differs substantially from the rest of Canada. All healthcare data is protected by the Personal Health Information Protection Act (PHIPA), regardless of whether it was collected by a clinician in the public sector or the private sector.
PHIPA states that patients must know where their healthcare data is being stored and must be informed if a breach occurs. This law does not state that healthcare data must reside on servers in Canada. There is a strong inclination to do so however, because Canadian healthcare providers are held responsible for full disclosure to the public when there is a problem.
5th Principle: Provincial and regional governments remain responsible for the data they own and subsequently share with therapists.
Pay close attention! If you are a private practice therapist in Canada, you must understand and comply with this principle. In British Columbia, Nova Scotia, Quebec and Alberta, it is important to distinguish between data collected by your business versus data collected by your provincial or regional government and then shared with your business.
If you are a contractor for a public body, there may be a privacy protection schedule attached to your contract. For example, a private practice therapist in BC might be surprised to learn about the obligation to comply with BC’s Freedom of Information and Protection of Privacy Act (FOIPPA) in order to work with clients from government programs such as WorkSafe BC or the Community Brain Injury Program.
This is because the public body remains responsible for the personal information that it owns and subsequently shares with you. There might be a government case manager involved, or case files that are passed to the therapist. Note that the government does not own basic contact information, like a person’s name, email and address.
Become a Confident Telepractice Professional
I hope my advice has helped you become more confident.
Stay in compliance with the privacy protection laws that apply to your work situation. If you have more than one workplace, do your best to understand the different regulations that apply. Stay informed so that you can avoid anxiety, conflicts and unnecessary expenses.
As a business owner, you can't avoid the legalities of online therapy services.
There is a chronological sequence that you will go through with every client, from a public enquiry to an archived case. There are privacy issues throughout this sequence.
Here is an overview of the phases of online service provision and some terms you should become familiar with. If you don't have my free e-book yet, click on the image for more information.
Phase 1: Marketing
Marketing involves interacting with the public to inform people about your services.
Sales Funnel: Your marketing efforts will look like an inverted triangle or funnel, with many people from the public entering at the top and only a limited number making the decision to become your clients.
Landing Page: This page is where the public lands when they click on a link in a search engine. It is different than the home page of your website. A landing page promotes a product or service. The purpose is to collect leads. A blog post can serve as a landing page. Sometimes landing pages have no menu because you don’t want the public to wander away from the page. Many landing pages have a strong call to action which people click in order to get something they want.
Generic Traffic: This means you are not using paid advertising to bring the public to your online content. They are finding the content by searching for it.
Cost Per Click: You might pay for traffic if you are not getting enough generic traffic. Online advertisers put your advertisement in front of an audience. In many cases, you get billed for the number of clicks on the ad. This cost per click is determined by many competitive factors.
Inbound Marketing: People have questions, and they are actively looking online for answers. Inbound marketing means that the public is finding you because they want a solution to a problem. By providing the public with information, you can help them decide if your services are a good fit for them. This is contrasted with traditional marketing which interrupts people and tells them about services they may have no interest in.
Lead: At the very beginning, someone from the general public might find your website, click on a few pages and fill in a form. By doing so, the person has become a lead. Your next step is to interact with that person.
Phase 2: Qualifying
Qualifying is a term that refers to narrowing down leads into potential clients. These people have not purchased services from you yet, but you have collected enough information to know that they meet the requirements for your telepractice.
Sometimes the lead is a family member or agency contact so it can take several interactions before the enquiry narrows down to an actual prospect for your telepractice services.
Support staff might be involved in processing enquiries. This might take place in person rather than via online interactions. There might be some screening that takes place, to ensure that the prospect is a good fit for the telepractice services that you are offering.
Qualified Prospect: This is a person who meets your requirements for telepractice.
Phase 3: Billing
Billing involves getting a commitment and getting paid. You need confidential processes for formal quotes, contract negotiations, funding applications, signatures, storing credit card information, billing accurately, issuing receipts and storing financial records.
Client: A qualified prospect converts to a client when a commitment is made. You offer services or a product and the client accepts your terms.
Conversion: The step of making a commitment to become a client is referred to as a conversion in your sales funnel.
Third Party Funding: The people getting the service are the first party. You are the second party. When the funding is coming from an agency rather than the people getting the service, it is called 'third party funding.'
Phase 4: Onboarding
Onboarding refers to the early phase of working with a new client. Your words and actions will either build rapport or sabotage it. Your new clients will be getting to know you. They will also be experiencing your tech processes and communication tools for the first time.
Buyer’s Remorse: Be mindful that buyer’s remorse often hits. This means that your new client regrets making a commitment. With new telepractice clients, the technology can be overwhelming for the client. Skillfully improving your onboarding process will help you keep clients and build your practice. If you show a lack of professionalism regarding privacy protection, your clients will feel nervous or offended. Make sure you know how to interact as a telepractice professional.
Phase 5: Maintaining
Maintaining clients beyond the first contract will help your business succeed.
Creating Data: While working with an active client, you will create clinical notes, progress reports, email messages and possibly some webcam recordings. All of this is data about your client. Most likely this data will be created in various forms, in various locations.
Accessing Data: You might retire or leave to work elsewhere. Another clinician might have access to all the information you collected about your clients. Eventually a clinician will close the case, but the data will still exist. Your employer or business will still be responsible for maintaining the privacy of that data.
Phase 6: Preserving
Preserving your physical records and online data and keeping all your information confidential remains your responsibility.
Teaching: The data might be viewed by your colleagues, supervisors and administrators. You might want to present interesting cases at a conference or use your recordings to teach students.
Marketing: You might want to use your success stories as testimonials. You might create a press release about your services.
Online therapists need answers about privacy protection.
I'm no longer in clinical practice, but I have not forgotten my early years.
When I graduated as an SLP, I started working part-time for the Vancouver Health Department and I immediately started seeing private clients. It is fairly common for a speech language pathologist to be employed in more than one setting. Many SLPs have a private practice in addition to a public sector job.
My first boss at the health department was an experienced SLP who taught me about caseload management. Essentially, all the administrative skills that I was learning in my public sector job were directly applicable to my private practice. Obviously, things have changed.
If you want to excel at running a online therapy business, there is a lot to learn! Online therapists need answers.
In BC, the rules for staying legal in your public job are not the same as the rules for staying legal in your business. This website will help you discover the contrasts between the privacy protection laws for public employment versus private employment. If you don't have my free e-book yet, click on the image for more information.
I didn’t know there was a difference until 2018. From 2014 until 2018, I was running a telepractice business without much interaction with professional colleagues.
In 2018, I joined a telepractice interest group organized through Speech and Hearing BC. I was surprised that employees in government jobs were required to follow strict policies, such as storing people’s personal information only on servers in Canada. Was I breaking the law by using a telepractice platform hosted on a global server?
In researching this question, I learned that telepractice providers in other regions of Canada faced different legal requirements than I did as a business owner in BC. If you are searching for answers online, you might come across advice intended for Ontario’s health care providers. Be judicious. It might not apply to your situation.
