Cybersecurity and Phishing: A 2026 Guide for Private Practice Therapists

An email that appears to come from a client, an unpaid-invoice notice, or a request to “reset your access” can be enough to compromise an account. In private practice, that is not merely an IT inconvenience. Email, scheduling, and clinical systems can contain highly sensitive personal information.

Good cybersecurity does not require becoming an expert or buying a long list of products. It means reducing easy mistakes, limiting who can reach records, and knowing what to do in the first minutes after an incident. This guide sets out a practical baseline for psychologists, social workers, psychotherapists, counsellors, therapists, and coaches. It does not replace professional-college requirements or legal advice.

Free. No credit card. Forever. FYL.care helps keep appointments, records, and practice administration organized without adding another monthly subscription.

Why a solo practice is a realistic target

Cybercriminals do not always choose a particular clinician. The Canadian Centre for Cyber Security explains that phishing commonly uses convincing messages at scale to obtain credentials, information, or payment. A small practice is exposed because it may depend on one email address, one computer, and a stream of time-sensitive exchanges with clients, insurers, and vendors.

A clinical file can combine a name, contact details, appointments, forms, receipts, and session notes. That combination makes the consequences of unauthorized access serious. Canadian privacy law requires safeguards appropriate to the sensitivity of the information. In Quebec, private-sector organizations must take reasonable security measures under the Act respecting the protection of personal information in the private sector. Security is therefore part of running a responsible practice, not an optional technical extra.

The common paths are ordinary: a fake Microsoft or Google sign-in link, an attachment supposedly sent by a client, a reused password exposed in another service’s breach, or a bogus request to change payment details. Ransomware can also encrypt local files and make records unavailable. The useful response is a set of small layers. No one layer is perfect; together they substantially reduce exposure.

How to spot a phishing message

A fraudulent email may have good grammar and a familiar logo. Before clicking, pause and check four things.

The real sender

Tap or hover over the displayed name to inspect the complete address. [email protected] is not [email protected]. Watch for a replaced letter, a free email account presented as a business, or an unexpected external sender.

The request

Phishing relies on urgency: “your account closes today,” “confidential document to sign,” or “confirm payment now.” A legitimate organization may ask you to act, but urgency plus an unexpected link or file calls for independent verification. Type the organization’s known address into the browser or call a number you already have; do not use the contact details in the suspicious message.

The link or attachment

On a computer, hover over a link without clicking. On a phone, go directly to the app or website instead. Do not open an unexpected attachment, especially a .zip, .html, .iso, .exe, or document asking you to enable content. A shared-document message can also lead to a fake login page.

The context

Were you expecting this document? Does the client normally use that address? Was a billing change previously confirmed? A call or a new message to a known address is often the safest check. Do not simply reply to the suspicious email: that may continue the conversation with the attacker.

The five safeguards with the highest payoff

1. Unique passwords stored in a password manager

Every account needs a long, unique password. Reuse turns an unrelated breach into access to your email or clinical platform. A reputable password manager generates and stores distinct passwords; it is safer than a spreadsheet or a notebook beside the computer. Secure it with a long passphrase and multi-factor authentication.

2. Multi-factor authentication wherever available

Multi-factor authentication (MFA) adds proof after the password: an authenticator app, security key, or, if necessary, a text message code. The Canadian Centre for Cyber Security recommends MFA to reduce the impact of stolen credentials. Enable it at minimum for email, the password manager, practice software, file storage, and financial accounts. Store recovery codes outside the primary email account in a secure location.

3. Automatic updates and encrypted devices

Updates fix known vulnerabilities, so postpone them only when necessary. Enable automatic updates for the operating system, browser, applications, and anti-malware protection. Encrypt the computer’s drive and set the screen to lock automatically. If a laptop is lost, encryption better protects data that remains on it.

4. Separate, tested backups

Synchronization is not always a backup: deletion or malicious encryption can synchronize too. Keep separate, encrypted copies with version history where possible. Periodically test restoring a non-sensitive sample in a safe environment. The Canadian Centre for Cyber Security recommends preparing backups before an incident; after an attack is the wrong time to learn that they are incomplete.

5. The minimum necessary information in messages

Do not put clinical details in an email subject line, text message, or consumer chat. For an appointment confirmation, the minimum—time, date, and contact method—reduces exposure. Use a secure portal or appropriate system for forms and documents, and decide who needs access to what. A channel being convenient does not automatically make it appropriate for health information.

A fifteen-minute monthly routine

Security becomes manageable when it is repeated. Put this administrative appointment on the calendar.

Review email sign-in alerts and connected devices.
Confirm MFA still works and recovery details are current.
Install outstanding updates.
Check that a recent backup exists and restore a sample at planned intervals.
Remove unused accounts, shared access, and third-party app permissions.
Review the incident procedure and key vendor contacts.

If an assistant or colleague has access, make onboarding and offboarding part of this routine: create individual accounts, never share passwords, remove access immediately when work ends, and document permissions. Shared accounts make it difficult to tell who viewed or changed a file.

What to do if you click or suspect an account compromise

Speed matters, but do not panic. If you entered a password on a suspicious page, change it immediately from a trusted device. Sign out other sessions, turn on or reset MFA, and change every account where that password was reused. Notify the account provider if its process calls for it.

If a device shows a ransom demand, becomes unusually slow, or opens unexpected windows, disconnect it from the internet and network without immediately wiping it. Record the time, affected accounts, and what you observed. Contact IT support or a qualified professional to preserve useful evidence and restore from a known-clean copy.

Then assess whether personal information may have been accessed, used, or disclosed without authorization. Under PIPEDA, organizations must report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada and notify affected individuals. Quebec organizations must keep a confidentiality-incident register and report incidents presenting a risk of serious injury to the Commission d’accès à l’information and affected people. Exact obligations depend on the facts and jurisdiction, so preserve the facts and obtain advice when needed.

Choosing tools without false confidence

Software does not replace a unique password or careful judgment about an email. Ask every provider: Where is information hosted? Is data encrypted in transit and at rest? Are MFA and access logs available? How can records be exported, an account deleted, and service restored after an incident? What is the vendor’s breach-reporting process?

Prefer tools that make sound habits easy: individual accounts, limited permissions, logged access, portable data, and clear security information. Document your choices. A practice does not need enterprise architecture; it needs consistent safeguards that the person responsible can actually maintain.

Free. No credit card. Forever. Use FYL.care to keep practice administration centralized and easier to review.

FAQ

Does a solo therapist really need MFA?

Yes. A solo practice’s email and records are still valuable targets. MFA makes a stolen password far less likely to be enough to open an account.

Is SMS MFA secure enough?

Text-message codes are better than no MFA. An authenticator app or security key generally offers stronger protection against some forms of fraud, so use the strongest option your provider offers.

Do I need to tell a client about every phishing email I receive?

Not automatically. Document and assess the incident. Notification duties depend on whether personal information may have been compromised and the level of risk; seek advice if uncertain.

Can I email a clinical note if a client consents?

Consent does not automatically make a channel secure. Minimize the information, check professional obligations, and use a method appropriate to the sensitivity of the document.

What is the first thing I should do today?

Enable MFA on your primary email account and replace every reused password with a unique password stored in a password manager.