Running online therapy sessions securely

The Telemedicine Practice Guidelines of March 2020 apply to registered medical practitioners, so they cover psychiatrists but not psychologists, counsellors or physiotherapists. They ask practitioners to follow "the relevant provisions of the IT Act, Data protection and privacy laws", accept consent that is implied when the patient starts the consultation, and ask doctors to keep logs of telemedicine interactions.

For psychologists, NIMHANS published Guidelines for Tele-Psychotherapy Services in April 2020, written for RCI-registered clinical psychologists and supervised trainees. They ask the therapist to share their RCI registration number, to get a parent's consent and the child's own assent for minors, to agree with the client that neither side records and to disable recording on the platform, and to store session records "in a secure physical location or online with adequate procedures for password protection and encryption."

For psychiatrists, the Telepsychiatry Operational Guidelines 2020 from NIMHANS, the Indian Psychiatric Society and the Telemedicine Society of India ask for explicit consent before recording, after explaining where the recording is kept and for how long, and for checks that the patient is who they say and cannot be overheard.

Most therapists use a mainstream video service. What their own documentation says:

• Zoom uses 256-bit AES GCM encryption by default, with keys managed by Zoom's servers. End-to-end encryption is available on free and paid accounts, but everyone must join from the Zoom desktop or mobile app, and it turns off cloud recording, live transcription and AI features (Zoom support).
• Google Meet encrypts all data in transit by default, and people who are not on the calendar invite must knock and be admitted by the host, who alone can remove or mute participants (Google Meet help).
• WhatsApp says personal calls are end-to-end encrypted so that not even WhatsApp can see them (WhatsApp privacy). The trade-off is that sessions sit beside the client's personal chats and you share your phone number.

If you use one standing room link for every client, admit each person yourself from a waiting room or lobby, so the next client cannot join while the previous session is still running.

1. Send the link only to the client, never in a public post or group.
2. Admit people yourself and lock out anyone you did not expect.
3. At the start, confirm who is on the call and that no one else is in the room on either side. Headphones help.
4. Agree a backup if the call drops, such as a phone call at a number you already hold.
5. Know where the client is for this session and who to contact in an emergency. India's national tele mental health helpline, Tele MANAS, is on 14416.
6. Do not record unless you both agree in writing, and know where the recording will be kept and for how long.
7. Keep clinical detail out of the call chat. Write notes in your secure records after the session.
8. Use an up-to-date app on a device with a screen lock, on a network you trust.