With all the talk about GDPR and the UK Data Protection Act over the past few years, most people know there are restrictions on sharing information relating to individuals. The regulations require that confidential information stays private, to the point that nobody but the intended recipient should be able to identify the individual concerned.
Anyone who has worked in health care, physical or mental, will also understand patient confidentiality. In practical terms it means refraining from discussing cases with anyone who is not authorised to be involved.
As individuals, one of our biggest fears is our private notes being leaked by a doctor or a therapist.
As a mental health professional, you are entrusted with some of the most intimate information a person has. Some of it would be moderately embarrassing if exposed. Some would be life-changing. For some people it could be life-ending. Perhaps that sounds alarmist, but given the work you do, it is not difficult to see how triggering the release of private information could be for someone already struggling.
Given the importance of the subject, my question to you is this.
Do you know all the places, physically and electronically, where private information about your clients past, present and potential is stored, transported, communicated or visible?
Most people would accept that bad things happen from time to time. Even so, most mental health professionals take limited action, because they underestimate either the probability of something going wrong or the impact when it does. "It'll never happen to me," they might say.
Unless you have proper controls in place across your entire estate, a small data or information leak carries significant risk to you, to your business and to your clients.
It only happens to other people? Wrong
In my time working with therapists, I have personally seen a UK NHS GP practice spamming its patients after being hacked, oblivious to the impact of the breach and to its own responsibilities, even after I contacted them on behalf of a client. I have seen a client's visits to their therapist become visible to people close to them, leading to outside interference. And I have seen sophisticated attempts to get therapists to unknowingly assist in abusing and embarrassing vulnerable people. This is no doubt just the tip of an iceberg.
Leaking psychotherapy clients' personal information
In October 2020, as was reported widely, the Finnish National Bureau of Investigation said the personal information of tens of thousands of clients of the psychotherapy business Vastaamo had likely been leaked into the public domain.
Vastaamo provided psychiatric and psychological treatment to people affected by conditions such as depression and anxiety. If you are a psychiatrist, clinical psychologist, psychologist, psychotherapist, counsellor or therapist, that description is going to sound familiar.
What risks does a mental health business face?
Whether you are a small therapy business or a large one like Vastaamo, the risk and the impact of client data leaking are similar. The risks are legal, financial and regulatory, and they damage your brand. The health and future of the business is heavily affected, and many therapists are put out of business overnight. Where owners are found negligent, or found not to have complied with legal requirements, large fines or custodial sentences can follow.
How were Vastaamo and its clients affected?
Vastaamo was asked by blackmailers for around EUR 400,000 in bitcoin to prevent the information being published, with a threat that records would be released in batches of 100 per day.
Over two days, leaks including the personal information and therapy notes of both adults and children began to appear on the dark web. The Finnish Interior Minister at the time, Maria Ohisalo, spoke of providing emergency crisis support to the victims. It is worth pausing on that, and asking how many other businesses are vulnerable to the same thing.
My business is too small, this will not happen to me
If you believe this cannot happen to you, I would ask you to think again, and to ask yourself how you know that, and what you are doing to protect against and mitigate the risks you face daily.
Put simply, if your therapy notes, or almost any identifiable information about your clients, leaks, then you stand to lose your livelihood, your business, your reputation, and possibly your freedom.
Identifying and reducing risk in a mental health business
I could ask whether you have done a risk assessment. You probably have. But not all risk assessments are equal, and it is unlikely that the one you followed is comprehensive enough to protect you and your clients.
Ask yourself whether it reliably covered every communications channel, email program, spell checker, filing cabinet, drawer and payment system you use.
If you are working from a standard template, the important question is what it is not covering. Its usefulness depends on the motivation behind it, and on your ability to answer the questions it poses properly.
How can I reduce the risks to my clients and my business?
Acknowledging that the risks exist is a good place to start. But what do you actually do, and what do you prioritise? Unless you have worked as a risk professional, it is difficult to know what to assess, or how to judge whether the controls you already have are working.
Running your business has probably become second nature. So much so that you may not notice how much information you have access to, or how you are using it.
Ask yourself today whether you understand your own processes well enough to write them down, along with the risks affecting them and the controls you have over them. There will probably be gaps, because this is not something we are used to doing, despite how much it matters.
What can you do to protect yourself?
Now that you know assessing and mitigating risk matters for every business, I hope you are motivated to go further: to understand, quantify and reduce the level of risk your business carries day to day.
Informing Minds is a business strategy consultancy for mental health practitioners. I carry out reviews and audits of your processes, risks and controls, covering both manual and technology based activities.
Read next
Find out more about reducing the risks to your business and your clients by contacting me at [email protected].
Protect yourself, ask an expert
Brian Tancock founded Informing Minds Limited. As a career risk professional he worked in and advised several multinational and global businesses. His focus these days is developing and supporting mental health focused businesses.