Privacy (Associate Handbook)

This section covers privacy-safe ways of working (client information, communications, storage).

What belongs here

• What channels are acceptable for what kinds of info (Jane messages, email, text)
• What not to put in email/text
• Storage expectations (where client information should live)
• “If something goes wrong” (lost device, mis-sent email/text, suspected breach)

Communicating about clients (privacy minimums)

Core principle

Client information is confidential. Only share what is necessary, with consent, and for legitimate clinical or legal purposes. If unsure, do not share—consult a supervisor.

✅ Do’s

1. Communicate on a need-to-know basis
   • Share client information only with:
     • the treating clinician(s)
     • supervisors/consultants (for clinical purposes)
     • authorized administrative staff (minimum necessary)
   • Ask: “Does this person need this information to do their job?”
2. Use client-centered, respectful language
   • Refer to clients professionally and respectfully.
   • Stick to facts, observations, and client-reported information.
   • Assume all notes or communications may be seen by the client.
3. Use secure communication channels
   • Use clinic-approved secure channels (e.g., JaneApp / secure email workflows).
   • Verify recipient identity before sending.
4. De-identify whenever possible
   • Remove names and identifying details when discussing cases for supervision, consultation, or training.
   • Use initials or general descriptors only.
5. Obtain informed consent
   • Get written consent before:
     • sharing information with third parties
     • releasing records
     • discussing cases outside the treatment team
   • Share only what is authorized.
6. Speak privately
   • Discuss client matters in private offices, behind closed doors, or in secure virtual spaces.
   • Be mindful of hallways, reception areas, elevators, and shared spaces.
7. Follow legal & ethical limits
   • Share without consent only when legally or ethically required (e.g., imminent risk of serious harm, mandatory reporting obligations, court orders).
   • Document rationale and actions taken.

❌ Don’ts

1. Do not discuss clients casually
   • No client discussions in public spaces, with friends/family/partners, or in social settings.
   • Even anonymized stories can be recognizable.
2. Do not use personal devices or accounts
   • Do not use personal email, personal messaging apps, or unsecured cloud storage for client information.
   • Please avoid screenshots or saving client info on personal devices.
3. Do not overshare internally
   • Do not share personal details that are not clinically relevant, or opinions/judgments/speculation.
   • More information ≠ better care.
4. Do not post or refer online
   • Never post about clients on social media/blogs/forums.
   • Even “disguised” stories can violate privacy.
5. Do not assume consent
   • Silence ≠ consent.
   • Prior sharing does not imply ongoing permission.
   • Always check current authorization.
6. Do not access files without reason
   • Only access records for clients you are treating, supervising, or are administratively authorized to support.
   • Curiosity is not a valid reason.
7. Do not delay reporting privacy concerns
   • If you suspect a privacy breach, report immediately to clinic leadership and document actions taken.

Clinic-specific rules (JaneApp-first)

• Please keep client-specific communication (especially anything clinical/therapeutic) inside the secure JaneApp workflow whenever possible.
• Please do not put clients’ first + last names in communications outside JaneApp.
• Please do not communicate sensitive therapeutic information outside JaneApp.
• If associates and admin must coordinate outside JaneApp for brief logistics, please use initials, first name only, or first name + last initial.

Exception: website submission form content (limited)

An exception to the above is submission form information that clients have entered into the website submission form. This information can be shared between admin and associates by copy/paste into email, as long as you do not include other identifying information (for example, do not add the client’s full name or other identifiers beyond what is already in the form content being forwarded).

Quick check before sharing

Ask yourself:

• ✔ Is this necessary?
• ✔ Is this authorized?
• ✔ Is this the minimum required?
• ✔ Is this secure?
• ✔ Would I be comfortable explaining this to the client?

If any answer is no, stop and consult.

Privacy incident / suspected breach (what to do)

If you become aware of or suspect an information/privacy breach—such as a lost device, a mis-sent email/text, or any hacking/unauthorized access risk that might give the public access to client information (e.g., name and contact information):

• Please notify admin immediately.
• Please notify Katherine immediately as well.

If you are able, please also take immediate containment steps:

• If it was a mis-sent email/text: attempt to recall/delete (if possible) and ask the recipient to delete it.
• If a device was lost/stolen: lock/remote wipe if available and change passwords.
• Avoid further sharing until admin/Katherine advise next steps.

Please also document it:

• Associates should make a brief, factual, dated note in JaneApp Notes recording the suspected or known breach of information privacy and what immediate actions were taken (keep details minimal and privacy-respecting).

Related:

• ../Policies_and_Expectations/Team_Communication_Channel.md (no client identifying information in team chat)