Digital privacy in mental healthcare: current issues and recommendations for technology use

Abstract

Mental healthcare providers increasingly use technology for psychotherapy services. This progress enables professionals to communicate, store information, and rely on digital software and hardware. Emails, text messaging, telepsychology/telemental health therapy, electronic medical records, cloud-based storage, apps/applications, and assessments are now available within the provision of services. Of those mentioned, some are directly utilized for psychotherapy while others indirectly aid providers. Whereas professionals previously wrote notes locally, technology has empowered providers to work more efficiently with third-party services and solutions. However, the implementation of these advancements in mental healthcare involves consequences to digital privacy and might increase clients’ risk of unintended breaches of confidentiality. This manuscript reviews common technologies, considers the vulnerabilities therein, and proposes suggestions to strengthen privacy.

Current Opinion in Psychology 2020, 36:25–31

This review comes from a themed issue on Cyberpsychology

Edited by Jon D Elhai and Dmitri Rozgonjuk

For a complete overview see the Issue and the Editorial

Available online 6th April 2020

https://doi.org/10.1016/j.copsyc.2020.03.012

2352-250X/© 2020 Elsevier Ltd. All rights reserved.

Mental healthcare has long held that privacy and confidentiality are primary in the service of clients [e.g., 1,2]. Moreover, psychotherapist-patient privilege has been upheld and supported by the U.S. Supreme Court [3]. Without privacy and confidentiality, therapy may not be effective [4]. However, technological progress has also come with consequences and risks for client privacy. We review current considerations and advancements for various technologies involved in the direct or ancillary provision of services, including emails, text messaging, telepsychology/telemental health therapy, electronic medical records, cloud-based storage, apps/applications, and assessments. We also consider threats and preventative measures to protect client privacy.

Direct use with clients

Email

Mental healthcare professionals use email for scheduling appointments and delivering treatments. The technology enables writers to have more permanence and spontaneity than oral conversations [5]. However, when communicating about Protected Health Information (PHI), email is more vulnerable to unintended breaches/losses than in-person communication [6,7^••]. Providers maintain less control over the third-party systems that send and maintain email, which affect their ability to ensure confidentiality [8].

Such a delegation of control poses potential threats to client privacy due to human errors (e.g., sending emails to unintended users), malicious acts, or metadata [9]. Even if the professional minimizes human error, unintended recipients may access and respond to the email [6,5,8]. Lastly, email phishing, which involves hackers posing as someone or an entity to access client data, has been emerging as a common concern for both providers and clients [10^•]. According to Elhai and Hall [11], 24.8% of surveyed psychologists reported breaches to their digital mailboxes. Email is also a frequent entryway for spyware and malware, which can be installed to allow malicious users to access the client’s PHI [9].

To avoid the threat to client privacy stemming from unsecured emails, Elhai and Frueh [6] recommend mental health professionals use in-transit encryption (i.e., when emails are accessed, read, and sent). Their research showed that 57.4% of their mental health professional research participants used encrypted email services to communicate with their clients [11]. Mental health providers should inform clients about the potential limits of confidentiality in email use [12], along with the risks, benefits, and people who may have access to them.

Text messaging

Text messaging (aka, texting or SMS) is widely utilized across multiple domains of psychotherapy, including psychoeducation [13], appointment reminders [14], treatment supplementation [15], and delivering interventions [16,17]. Clients increasingly expect to be able to contact providers via text messaging [18]. Although, incorporating text messaging in practice or clinical research may involve novel ethical concerns.

Threats to text messaging privacy can emerge from individual, corporate, and government actors [19]. For instance, phones may be hacked by individuals in an effort to glean private data, corporations may scan and retain text messaging data by default for advertising and marketing purposes, and government agencies may intercept text messages through broad surveillance programs [19]. Elsewhere, it may be difficult to know whether a client is alone when receiving a text or whether they are actually the one texting [20]. Clients may wrongly assume that only providers can access messages, further undermining informed consent [19,20].

To minimize ethical threats, providers should discuss information security directly with clients at treatment onset, and revisit the topic periodically [21]. Notification settings should be adjusted to ensure messages do not appear when the phone is locked or are deidentified [20]. Mental health providers may also consider adopting phones that allow for end-to-end encryption of text messages by default [e.g., Apple’s Messages to other iOS users; 19,22,23]. If end-to-end encryption is not possible with native software/apps, providers may choose to adopt alternative messaging apps that offer end-to-end encryption [e.g., Signal; 22,24]. Finally, Drolet [22] advises that providers should be wary of claims of ‘Health Insurance Portability and Accountability Act [HIPAA; 25]-compliant’ text messaging services (p. 2369). ‘HIPAA-compliant’ is not a regulated or certified term by the Department of Health and Human Services. Despite claims, providers concerned with compliance are encouraged to de-identify information when transmitted via text message [22].

Telepsychology/telemental health therapy

Numerous terms describe the provision of mental health care via tele/video-conferencing (e.g., televideo or telehealth). For the purposes of this manuscript, we use telepsychology or telemental health therapy (TMHT) as inclusive terms to refer to interactive videoconferencing between mental health providers and clients, ranging from the provision of psychotherapy to medication management. This modality of service delivery has rapidly expanded in recent decades given the ability to mitigate costs and increase access to mental health services [26, 27, 28]. TMHT shows particular promise for clients whose access to care is otherwise hampered by situational factors, including rural location, physical health condition, and transportation options [29,30].

Despite the benefits, TMHT services present unique risks to client confidentiality [31^•,32]. TMHT sessions may be unintentionally overheard or even maliciously observed by outside parties [33^•]. Barnett [31^•] recommended that TMHT practitioners ‘safeguard’ client confidentiality through encryption, HIPAA-compliant software, and protections against adware, malware, and firewalls (p. 424). While Skype or Facetime may be most familiar to clients and providers, more secure and HIPAA-compliant video-conferencing platforms exist [e.g., Doxy.me; 6]. Additionally, TMHT may be affected by the client’s location and physical safety.

Shore and colleagues [34] describe best TMHT practices for protecting client privacy, including beginning each session with a thorough verbal assessment of the client’s location, the presence of other individuals in the space, and the volume of transmitted audio. Clients may video-conference in their home or workspace, making the private, session content potentially discernible to family members or colleagues. Moreover, some clients may need in-person assistance before engaging in remote therapy [34]. Practitioners should assess the confidentiality of clients in these situations and be transparent about the features and risks during informed consent processes [35].

Apps

‘Apps’ (mobile applications) are self-contained programs for use on smartphones or tablets [36]. Development and utilization of clinical, treatment-related apps have increased since 2008 [36]. According to the latest estimates, 165,000–325,000 health and wellness apps are available, and over 10,000 apps are designed for mental health [37]. Mental health apps may include reminders and often require clients to record (e.g., written or audio) their symptoms for reviewing the past session or preparing for future sessions [38^••,39].

Threats to data privacy via apps are increasing [38^••]. Many clients report privacy concerns, which inhibit and discourage use of health-related apps [40,41]. When using apps, various data points are frequently shared with the developers. For instance, behaviors and information (e.g., username and password, contact information, age, gender, location, International Mobile Equipment Identity (IMEI), and phone number) are often monitored by app companies, and some data are sold to third parties [42]. Relatedly, some app privacy policies and terms do not consensually request users for their data [38^••].

To address these concerns, providers should acknowledge limits of confidentiality and encourage minimal PHI use and disclosure within apps [43,44^•]. In the event of device loss/theft/removal, utilizing remote data wipe tools may be helpful [44^•]. Apps are more popular among adolescents than adults. However, younger populations may not understand the implications for privacy and the permanence of digital footprint; special attention needs to be paid when discussing privacy and consent with adolescents and their parents [45].

Digital assessments

Providers traditionally used paper and pen/pencil for assessments [46^••]. One leading assessment company, Pearson Education Inc., began offering digital versions in 2013. For example, the Wechsler Adult Intelligence Scale-Fourth Edition (WAIS-IV), Wechsler Intelligence Scale for Children-Fifth Edition (WISC-V), and Wechsler Memory Scale-Fourth Edition (WMS-IV) are now offered as digital assessments [47]. These digital assessments are conducted with two Apple iPads that connect via Bluetooth (between the two) and then are sent to Pearson’s servers for scoring and storage [46^••,48].

A paucity of research has been conducted about the legal and ethical risks for digital assessment use. As more assessment companies and mental healthcare providers utilize digital assessments, confidentiality remains a key ethical concern [46^••]. Data may be electronically transmitted from the testing/assessment device, leaving providers responsible for maintaining HIPAA regulations [49]. Risk regarding test security and data may also increase in online, digital environments [50].

Providers considering the use of digital assessments should offer informed choices to examinees (or their custodians) and options for tech or paper-based versions (e.g., risks and benefits to using digital assessments). Professionals should consult with assessment specialists for training on differences. Similarly, Apple iPads used for assessments should be designated as sole-purpose devices (i.e., only for digital assessments) to reduce risk of data loss or unintended breaches in confidentiality for devices used in multiple settings. Training programs would likely benefit from incorporating-specific instruction about using technology in the provision of assessments, as well.

Ancillary to client care

General hardware considerations

Regardless of the software/app used, providers must interact with hardware (e.g., smartphones or laptops). For instance, phones are a widespread hardware used for communication between mental healthcare professionals and clients [51,52], which have been employed for decades [53]. However, with the advent and popularization of smartphones and other mobile devices, risk of involuntary disclosure of PHI is greater [44^•,54].

Some common phone user behaviors can increase risks of loss or theft, such as leaving their non-password protected device unattended or carrying the device in less secure ways (e.g., handbag or backpack). In fact, 16.8% of security breaches reportedly occurred due to the loss/theft of a smartphone [11]. Elsewhere, while providers may be tempted to utilize new biometric data security measures for securing and unlocking their phones (e.g., fingerprint or facial recognition), a recent U.S. District Court case ruled that law enforcement can legally compel users to unlock their phones via such biometric data [55]. Situations where providers are likely to engage with law enforcement (e.g., international border crossings) present additional threats to client confidentiality of stored text messages. Because prior U.S. case law [e.g., 56] protects individuals from being compelled to reveal number passwords to law enforcement (but not biometric data), providers may consider adopting numerical passwords over biometric data security measures in their professional practice [57].

Mental health professionals are encouraged to verify that the person on the phone is the client [58,59] and should also acknowledge that more confidential means would be via oral and/or written mediums. For example, practitioners may ask each of their clients to complete progress monitoring measures on a shared tablet in the waiting room. Special precautions should be taken to prevent autofill on shared devices to ensure that client data are not inadvertently shared with unauthorized parties [60].

Electronic medical records (EMRs)

An EMR is a computer database that allows healthcare administrators and providers to document information related to patient care [61]. Because of its efficiency and accuracy in documentation relative to paper-based individual documentation, the use of EMRs by government and private medical providers has been on the rise [10^•,61]. The National Center for Health Statistics [62] estimates that 85.9% of American doctors in an office setting use electronic health/medical records.

Using an EMR system involves issues related to client privacy, such as how much information is appropriate to place in an EMR, especially when that record is accessible to professionals throughout an organization [61,63^•,64,65]. To illustrate, as the other health providers and administrators can access the client care information, each document that mental health professionals create can both intentionally and unintentionally inform all related and unrelated providers and administrators [63^•]. Therefore, researchers highlight the importance of fair information practices to reduce any patient digital privacy violations [10^•,61,66].

Most informed consent in integrated healthcare settings include limits of confidentiality; however, clients may not always realize what information contained within an EMR is shared with others [63^•]. Also, mental health professionals should discuss unique risks of EMRs as well as data storage issues. Risks include system breaches, crashes, and losses of unprotected backups of electronic PHI [66]. Data storage issues include how their PHI is used, transmitted, stored, and retained in the EMR [67]. Such fair information practices include the least-intrusive, least identifiable, minimally sensitive disclosure to the fewest number of persons as reasonably necessary to achieve the service goals [68].

Cloud-based storage

For mental health practices — large and small — scalability of technology solutions allows for growth of client records without increasing physical footprint or risk to local data. Before the advent and popularization of cloud-storage solutions, providers tended to utilize local hard drives to store document/client notes on their own computers [6]. Over time, cloud storage allowed for greater ease of access to files across devices, locations, and providers. The movement of records to the cloud reduces the risk of fire, flood, natural disaster, and theft/loss associated with local hard drives and/or hardcopy, paper records [6,69].

Various cloud-storage providers market their products as HIPAA compliant [19,70], which may ease the burden on providers to navigate complex regulations and security standards. HIPAA has 18 PHI indicators, some of which include birth dates, addresses, session dates, names, and session notes [71]. By signing business associate agreements (BAAs), psychologists must also maintain privacy and security responsibilities for their own devices.

Storing information online might also challenge providers’ awareness of encryption standards, password and device management, and record keeping practices [69,72]. Client records placed in cloud storage increase the risk of unintended breaches in confidentiality and unauthorized access from a distance [9,19,70]. Additionally, various threat actors should be considered, as individuals, organizations, and governments might desire information from clients’ records via cloud storage [6,19]. Traditionally underserved populations located in more rural locations and/or with a lower socioeconomic status (SES) also may not have the same technological protections that providers have, which might jeopardize their data stored in the cloud [73]; in these circumstances, other options may be warranted.

Conclusion

In The Innovators, biographer Walter Isaacson [74] writes, “Innovation occurs when ripe seeds fall on fertile ground.” The 21st century has been highly prosperous for technology companies and their creations. This development has spurred new ideas, thinking, and approaches to the provision of services in the field of psychology.

From rotary phones for calling a client to emails and TMHT, the evolution of practice has been deeply informed by innovation. The use of email, text messaging, TMHT, electronic medical records, cloud-based storage, apps, and digital assessments have all aided providers in their search for efficient and effective care. Moreover, in the face of pandemics or other crises such as COVID-19 (Coronavirus), technology has empowered providers to continue seeing clients from afar when in-person meetings are impossible (e.g., APA’s [75] Disaster Mental Health informed consent checklist for telepsychological services).

Simultaneously, mental healthcare providers have been challenged with each advancement in technology use for psychotherapy delivery and general services — from the ethical, legal, and training ramifications of what is implemented. Moving data to digital domains may tax providers’ abilities to maintain privacy of PHI. In the face of growing need for technology in practice, providers should consider opportunities for growth and education before use. Providers should engage with relevant literature, attend conferences and continuing education opportunities, and solicit feedback from colleagues, as these actions will likely benefit their work and clients. Ultimately, we implore you to ask, how might this technology affect your clients’ privacy? The answers will be crucial for maintaining ethical practice in the future of mental healthcare.

Conflict of interest statement

Nothing declared.

References and recommended reading

Papers of particular interest, published within the period of review, have been highlighted as:

• • of special interest

• •• of outstanding interest