Privacy and Confidentiality in Therapy

Therapists / counselors are bound by ethics and law (and because it’s the right thing to do) to keep communication with clients confidential and private.  We are required to keep your identity, your identifiers and your health information secure, private, and confidential.  We are also required to keep “the fact of the relationship” confidential. This means that therapists / counselors are not allowed to let anyone know that you are in therapy with them without your express, written permission.

HIPAA (United States) and GDPR (European Union) mandate that therapists / counselors protect your name, contact information, the IP address of your device(s), and all your health information.  Therefore, therapists / counselors keep communication with clients secure, encrypted and private, just between the two of us.

Therapists keep client records secure by working with providers under a Business Associate Agreement (BAA). A BAA binds the service provider to keep your information confidential, not record  or harvest other information about you from your computer, and not to sell it. The only time the platform is allowed to disclose information is when it is required by law, e.g., in cases of illegal activity on their platform.

For clients located in the US, I comply with Health Information Portability and Accountability Act (HIPAA) and use secure, encrypted communication.

For clients located in Europe, under General Data Protection Regulation (GDPR) rules governing the European Union, I am required to let you know what information I collect, where and how it is stored, and the lawful purpose for which I collect it. Answers are below.

GDPR IN THERAPY

Under GDPR, it is my duty to protect your confidential information, even if you want to waive your right to privacy. Please do not include any health-related information or discussion about your concerns in unencrypted communication with me.  Texts, unencrypted messaging and unencrypted email are not private.

This website uses cookies and cloud storage.  Your IP address is anonymized and user information is collected and aggregated.  The lawful purpose for collecting this information is instrumental, for website functionality.

I request that clients communicate with me via ProtonMail email.  Accounts are free and easy to set up, encrypted, private, and secure. It takes about 5 minutes to set up an account.

I will only ask you for information necessary to conduct online therapy / online counseling and contact information in case of emergency or technical problems.  All information will be stored on paper in double locked files for 8 years, as required by my insurance company.  The lawful purpose for collecting the information is the performance of contractual obligations on the part of therapist / counselor to the client.

Email:  PROTONMAIL.COM (Now rebranded as proton.me; I was an early adopter.)

Calls and messaging: SIGNAL

Online meetings with clients over the internet / for online therapy / online counseling / telehealth / tele-mental-health: ZOOM with a HIPAA and GDPR-compliant Business Associate Agreement.