Privacy Incidents in Private Practice: A Therapist’s Response Plan

A clinical email sent to the wrong person. A laptop left in a café. A compromised account. In private practice, a privacy incident can begin with a mistake that takes seconds, but the response needs structure.

In Quebec, Law 25 requires organizations to assess the risk of serious harm, notify affected people and the Commission d’accès à l’information when the threshold is met, and keep a record of all privacy incidents. This practical plan helps you respond without making the situation worse.

1. Stabilize the situation first

Your first priority is to limit disclosure, not to find someone to blame.

• Recall or disable a link shared by mistake.
• Ask the unintended recipient not to open, copy or forward the document, then to delete it.
• Disconnect a compromised device from the network without wiping it.
• Reset affected credentials and enable MFA if it is not already active.
• Preserve logs, emails, screenshots and exact timestamps.

Do not destroy evidence or send an improvised explanation to every client before you understand the facts. Assign someone to coordinate the response, even in a solo practice: define the role in your internal plan and name a backup contact.

2. Describe the facts without guessing

Create a short incident record and timeline:

1. When was the incident discovered?
2. Which system, device or medium is involved?
3. What personal information may be affected?
4. How many people could be involved?
5. Who may have accessed it, and for how long?
6. What containment measures have already been taken?

Separate what you know from what you still need to verify. A useful record includes the system, information categories, people notified, decisions made and closure date. Keep unnecessary clinical details out of coordination emails.

3. Assess the risk of serious harm

The question is not simply “was there a disclosure?” It is “does this incident create a real risk of serious harm to an individual?” Consider at least:

• the sensitivity of the information, such as a clinical note, diagnosis or violence-related information;
• the likelihood it will be misused or further disclosed;
• the type of access: known wrong recipient, stolen device, exposed account or active attack;
• safeguards that reduce the risk, such as rapid link removal or encryption;
• any particular vulnerability of the affected person.

Document your reasoning even when you decide that notice is not required. In Quebec, the record covers all privacy incidents, not only those that meet the serious-harm threshold. Requirements may differ when a provincial or federal regime applies to your practice; seek professional advice when unsure.

4. Notify the right people at the right time

When a serious-harm risk is established, the organization must notify the Quebec Commission d’accès à l’information and affected individuals diligently. The notice should explain, in plain language, what happened, what information was involved, what steps were taken and what the person can do to protect themselves.

If your practice is subject to PIPEDA, the Office of the Privacy Commissioner of Canada also requires reporting breaches that pose a real risk of significant harm, notifying affected individuals and keeping breach records. The applicable regime depends on the context and province; do not assume one form or deadline replaces another.

Never put a list of affected clients in a visible email copy. Use a secure channel, verify addresses and have a significant incident reviewed by legal counsel or your insurer.

5. Fix the control that failed

After containment, identify the missing control:

• mandatory second-person or second-step attachment checks;
• individualized links with expiry dates;
• MFA for email, clinical software and devices;
• encryption and automatic screen locking;
• tested backups separated from the primary network;
• an offboarding process that removes access;
• short, repeated phishing training.

The Canadian Centre for Cyber Security recommends that an incident response plan include roles, communications, backup and recovery. Test it annually with a realistic scenario: “a phone with an open session is lost” is enough to expose several gaps.

6. Keep this checklist outside your software

Maintain a printed or offline copy of these contacts and steps:

• privacy officer or person responsible for privacy;
• software vendor and emergency procedure;
• professional liability and cyber insurer;
• legal counsel;
• Quebec Commission and federal Privacy Commissioner, as applicable;
• account-reset procedure;
• backup location and last test date.

FYL.care helps practitioners centralize administrative records and practice follow-ups in a structured workspace. Explore FYL.care to reduce information sprawl.

FAQ

Do I have to report every email sent to the wrong person?

Every incident should be assessed and recorded. Notice to the Quebec Commission and affected people depends on the serious-harm risk and the privacy regime that applies.

What if I do not know whether a file was opened?

Preserve available logs, ask the vendor to confirm access and document the uncertainty. Lack of evidence is not automatically evidence that there was no access.

Can I manage a privacy incident alone in a small practice?

You can coordinate first steps, but plan in advance for help from your vendor, insurer and a specialist adviser. A small practice still has privacy responsibilities.

Is an incident record mandatory in Quebec?

Yes. Businesses must keep a record of privacy incidents involving personal information and provide it to the Commission on request.