
Maintaining clients over time often involves communication within treatment teams.
Q: Is consent assumed in workplace communication, allowing colleagues to discuss a case?
The key concept to remember is that the data belongs to the organization that has collected it. The organization is responsible for maintaining the confidentiality of the information.
Specific levels of consent are assumed in workplace discussions between colleagues. This is tied to the role and responsibilities of the employee. People working within an organization have access to the internal data that is appropriate for their security clearance level. They are allowed to have case discussions with others that have similar roles and responsibilities.
Organizations are required to have safeguards in place so that people who don't have security clearance cannot access the information. Leaving a confidential file on top of a desk overnight would be inappropriate because the cleaning staff would be able to read that file. Similarly, having a case discussion in a public cafeteria or elevator would be inappropriate. Security badges, locked doors and passwords are all examples of safeguards that protect the privacy of clients.
Q: Should supervisors or students be able to observe telepractice sessions in a clandestine way, without their participation being obvious to the client or clinician?
Sometimes a clandestine observation is better than an interruption which derails the session. Your policy regarding observations should be explained at the beginning. It should be part of the informed consent. ZOOM Cloud Meetings offers this for agency accounts, but not individual accounts.
Q: Can my coworkers see my clinical notes?
Yes, many workplaces use some type of central, secure storage for data so that the data survives long after you are gone. If you retire or move to another job, the information about your past clients will stay with the organization.
Q: My workplace has a VPN which I use when I work from home. What is that?
Here are some definitions that you should know:
Intranet: An intranet is a private LAN accessible only to an organization’s staff. Intranets can act as communication hubs for organizations. If you are an approved employee, you can store information such as clinical records, staff news and announcements centrally and your co-workers will be able to access the information at any time.
Intranet versus Internet: There is one major distinction between an intranet and the Internet: The Internet is an open, public space, while an intranet is designed to be a private space.
Remote Access Server (RAS): A remote access server is a type of server that provides a suite of services to remotely connected users over a network or the Internet. It operates as a central server that connects remote users with an organization's internal local area network (LAN). Thus, an approved employee would be able to log into the private space without being in the building. It allows employees to work remotely.
Virtual Private Network (VPN): A VPN allows you to create a secure connection to another network over the Internet. If you are working for an agency from a remote location, your agency will want to prevent unauthorized people from being able to access the private space. A VPN encrypts everything from end to end and makes it appear as though you are in the same location as the server that you are logging into.

As a business owner, you can't avoid the legalities of online therapy services.
There is a chronological sequence that you will go through with every client, from a public enquiry to an archived case. There are privacy issues throughout this sequence.
Here is an overview of the phases of online service provision and some terms you should become familiar with.
Phase 1: Marketing
Marketing involves interacting with the public to inform people about your services.
Sales Funnel: Your marketing efforts will look like an inverted triangle or funnel, with many people from the public entering at the top and only a limited number making the decision to become your clients.
Landing Page: This page is where the public lands when they click on a link in a search engine. It is different than the home page of your website. A landing page promotes a product or service. The purpose is to collect leads. A blog post can serve as a landing page. Sometimes landing pages have no menu because you don’t want the public to wander away from the page. Many landing pages have a strong call to action which people click in order to get something they want.
Generic Traffic: This means you are not using paid advertising to bring the public to your online content. They are finding the content by searching for it.
Cost Per Click: You might pay for traffic if you are not getting enough generic traffic. Online advertisers put your advertisement in front of an audience. In many cases, you get billed for the number of clicks on the ad. This cost per click is determined by many competitive factors.
Inbound Marketing: People have questions, and they are actively looking online for answers. Inbound marketing means that the public is finding you because they want a solution to a problem. By providing the public with information, you can help them decide if your services are a good fit for them. This is contrasted with traditional marketing which interrupts people and tells them about services they may have no interest in.
Lead: At the very beginning, someone from the general public might find your website, click on a few pages and fill in a form. By doing so, the person has become a lead. Your next step is to interact with that person.
Phase 2: Qualifying
Qualifying is a term that refers to narrowing down leads into potential clients. These people have not purchased services from you yet, but you have collected enough information to know that they meet the requirements for your telepractice.
Sometimes the lead is a family member or agency contact so it can take several interactions before the enquiry narrows down to an actual prospect for your telepractice services.
Support staff might be involved in processing enquiries. This might take place in person rather than via online interactions. There might be some screening that takes place, to ensure that the prospect is a good fit for the telepractice services that you are offering.
Qualified Prospect: This is a person who meets your requirements for telepractice.
Phase 3: Billing
Billing involves getting a commitment and getting paid. You need confidential processes for formal quotes, contract negotiations, funding applications, signatures, storing credit card information, billing accurately, issuing receipts and storing financial records.
Client: A qualified prospect converts to a client when a commitment is made. You offer services or a product and the client accepts your terms.
Conversion: The step of making a commitment to become a client is referred to as a conversion in your sales funnel.
Third Party Funding: The people getting the service are the first party. You are the second party. When the funding is coming from an agency rather than the people getting the service, it is called 'third party funding.'
Phase 4: Onboarding
Onboarding refers to the early phase of working with a new client. Your words and actions will either build rapport or sabotage it. Your new clients will be getting to know you. They will also be experiencing your tech processes and communication tools for the first time.
Buyer’s Remorse: Be mindful that buyer’s remorse often hits. This means that your new client regrets making a commitment. With new telepractice clients, the technology can be overwhelming for the client. Skillfully improving your onboarding process will help you keep clients and build your practice. If you show a lack of professionalism regarding privacy protection, your clients will feel nervous or offended. Make sure you know how to interact as a telepractice professional.
Phase 5: Maintaining
Maintaining clients beyond the first contract will help your business succeed.
Creating Data: While working with an active client, you will create clinical notes, progress reports, email messages and possibly some webcam recordings. All of this is data about your client. Most likely this data will be created in various forms, in various locations.
Accessing Data: You might retire or leave to work elsewhere. Another clinician might have access to all the information you collected about your clients. Eventually a clinician will close the case, but the data will still exist. Your employer or business will still be responsible for maintaining the privacy of that data.
Phase 6: Preserving
Preserving your physical records and online data and keeping all your information confidential remains your responsibility.
Teaching: The data might be viewed by your colleagues, supervisors and administrators. You might want to present interesting cases at a conference or use your recordings to teach students.
Marketing: You might want to use your success stories as testimonials. You might create a press release about your services.

Obtain client consent for case studies while therapy clients are still on your active caseload.
Q: Can I use clinical videos for educational purposes?
You can share information with authorized people within your workplace. You should obtain written client consent for showing your images and videos to anyone outside of your public organization or private company.
Always ask for consent to use recordings for educational purposes. Do this at the beginning, when they become your clients. If they move away and you lose their contact information, you won’t be able to request consent later.
If you will be showing images and videos at a public event like a conference, or on your website, do not reveal identifying information about the person.
When you are making a recording, remember not to say the name of the person. Keep your video clips short. Use clinical descriptions to name the files, rather than using the name of the person.
Q: Can I ask clients for testimonials?
Testimonials are a big part of social media. Sometimes clients are eager to give you a rating and recommend your service. If you use a service such as YELP, the client is responsible for creating the testimonial and making it public, thereby shielding you from breaching any privacy laws.
Don't ask clients to post testimonials because the comment will be linked to their social profile. There is no privacy.
Instead, you can ask for feedback by email. Shorten testimonials and make spelling corrections. Post the testimonials on your website using initials rather than full names. This method provides you with social proof while protecting each client’s identity.
You can use social media to congratulate clients on making progress in therapy. To do this, post objective data that shows before and after scores. Use the client’s initials and avoid adding any identifying details.
Q: Can I use case studies in my marketing? Can I submit pictures of clients with a press release?
Case studies and news stories help to build your credibility. Show clients the drafts and get written consent before you make the information public.

Private practice therapists in Canada should be aware that PIPEDA applies to free consults.
Q: Do private practice therapists need consent to offer free consults?
Private practice therapists in Canada must be vigilant about getting consent to offer free consults because of PIPEDA, the Personal Information Protection and Electronic Documents Act. This is a Canadian law that shares some of the principles contained in the US law known as HIPAA, the Health Insurance Portability and Acountability Act. The emphasis is on accountability. PIPEDA states that a private business must not collect names, addresses and background reports if the company does not have consent to have that information. Furthermore, a private business must make reasonable efforts to ensure that the individual is advised of the purposes for which his or her information will be used or disclosed, and state the purposes in a manner that the individual can reasonably understand.
Get Written Consent
Reduce your risk by getting written consent early in your interactions with the public. Create online referral and consent forms for your website. I teach private practice therapists how to do this in the AttractWell platform. People fill these in before they book any appointments. When an agency wants to set up a contract, ask the agency to direct the family to the URL with the consent form.