June 11, 2024

Episode 68:

How to Maintain Client Confidentiality When Using Social Media

In this episode, I’ll break down how to use social media so that you avoid privacy breaches and maintain your client’s confidentiality.

Episode 68: How to Maintain Client Confidentiality When Using Social Media

Show Notes

Welcome back to the Designer Practice Podcast, and I’m your host, Kayla Das.

Today, I actually have a special guest with us. As many of you guys know, I have been on maternity leave. And now that I’m back into things, I actually have my daughter with me. So, if you hear any coos or anything along the way, just know that’s her. But yeah.

So, let’s get into today’s episode.

So, social media is a great tool for therapists to connect with one another, build our practices, and essentially grow as therapists. However, with the use of social media platforms, it’s important to understand how to use social media in a way that’s compliant with privacy laws and maintains our client’s confidentiality.

Over the last several years, therapists have been looking to social media more and more in order to find support with specific client cases, obtain referrals for clients, and essentially grow their practice overall. But with that there are several considerations before posting on social media, specifically when it relates to any client information.

In today’s episode of the podcast, I’ll break down how to use social media so that you avoid privacy breaches and maintain your client’s confidentiality.

But before we dive in though, I want to give a disclaimer that I am not a lawyer, nor should the content in this episode be considered as legal advice and that it’s advised to seek legal counsel for legal advice. In addition, it’s important to review and consult with your regulatory body’s codes of ethics and standards of practice with respect to your own practice and social media usage as every jurisdiction and regulatory body may have differing legislation, codes of ethics, and standards of practice. Please be advised that this episode and its contents are my opinions and interpretations only.

What is Confidentiality?

So, what exactly is confidentiality?

As therapists, the ideal to maintaining confidentiality is drilled into our practice from the day we enter into our therapy programs. However, what it is exactly can be a little more nuanced. Throughout the years, I’ve heard various interpretations of what maintaining confidentiality actually means. I’ve heard it referred to as never speaking about client issues. I’ve heard it referred to as only sharing information that isn’t identifiable, such as a person’s name or address.

But what exactly is the right answer? Well, let’s break down some of the legislation, the codes of ethics, and standards of practice. Specifically for the purpose of this episode, I’ll be discussing PIPEDA, which is the Canadian privacy law, and the Canadian Association of Social Workers Code of Ethics, along with specific Canadian provinces standards of practice for social work. As I mentioned earlier in this episode, different jurisdictions and different professions may have differing legislation, requirements, and even the expectation for social media use. So again, these are what I’m going to refer to, but it’s always important for you to understand your privacy legislation in your province, state, or country as well as your own regulatory body’s standards of practice and code of ethics.

What is PIPEDA?

So here in Canada, the federal privacy law is called PIPEDA, which stands for Personal Information Protection and Electronics Documents Act. PIPEDA is legislation that all private sector organizations are required to follow unless you are required to follow a provincial privacy legislation, there are some provinces that have province specific, but again, for the purpose of this episode, we’re going to talk about PIPEDA as a whole. According to the Office of the Privacy Commissioner of Canada, PIPEDA is and I quote, “sets out the grounds for how businesses must handle personal information when it comes to business practices.” (Office of the Privacy Commissioner of Canada, 2018, January).

Some of the notable principles under PIPEDA that we’ll be discussing in this podcast are one, that private practices or any business for that matter are accountable for protecting the personal information of clients, that the reason for collecting personal information must be disclosed to the client prior to as well as during the collection stage. So usually for therapists, this is the consultation or intake stage, as well as beyond in our therapy sessions and other correspondences with our clients. And also, that any collection or disclosures of personal information of a client must be with the knowledge and consent of that client, with some exceptions that’s outlined in PIPEDA. And then finally, that “personal information must only be used and disclosed for the purpose for which it was collected, again, except when consent or required by law.” (Office of the Privacy Commissioner of Canada, 2004, November).

There are additional considerations under PIPEDA that you may wish to familiar yourself with, but we’ll only be discussing those that I have mentioned, but I’ll also have links to the information regarding PIPEDA or any other reference that I refer to in today’s episode in the show notes. So, feel free to scroll down and click on any relevant links so you can review.

What’s Considered Personal Information under PIPEDA?

So, when it comes to PIPEDA, what exactly is considered as personal information?

So, I’m going to read out exactly what the Office of the Privacy Commissioner of Canada website says, and how it defines personal information. So, I quote, “Under PIPEDA, personal information includes any factual or subjective information, recorded or not, about an identifiable individual, that includes information in such forms as age, name, ID numbers, income, ethnic origin, blood type, opinions, evaluations, comments, social status, or disciplinary actions, and employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions, for example, to acquire goods or services or change jobs.” (Office of the Privacy Commissioner of Canada, 2019, May).

As you might notice that PIPEDA doesn’t only define personal information as your clients, but also that of your staff and contractors as well. So although we often consider confidentiality of our clients, under PIPEDA, there is an expectation that you maintain privacy of those that you have work for you or do work for you.

But in this episode, we’re going to talk more about the client side of things. And when it comes to clients, some of the things that I find notable about this definition is that, quote, personal information includes any factual or subjective information, recorded or not, about an identifiable individual. Because when we think of how we use social media, whether for marketing purposes, seeking referrals for a client, or asking for support or advice from other therapists with respect to client situations, we would certainly want to keep this in mind before we post anything that would be considered client’s personal information.

Social Work Code of Ethics and Confidentiality

So, what does the Canadian Association of Social Workers Code of Ethics say about confidentiality maintenance?

Within the CASW Code of Ethics, which I’ll link in the show notes of this episode, confidentiality has its own section called Value 5: Confidentiality in Professional Practice. When it comes to the topic of confidentiality, according to the Canadian Association of Social Workers, social workers must, and I quote, “respect the client’s right to confidentiality of information shared in a professional context,” “only disclose confidential information with the informed consent of a client, or permission from the client’s legal representative”, and “demonstrate transparency with respect to limits of confidentiality that apply to their professional practice by clearly communicating these limitations to clients early in the relationship.” (Canadian Association of Social Workers, 2005).

In addition, the Canadian Association of Social Workers website states that “in private practice, confidentiality and privacy rights are the social worker’s ethical and legal responsibility and need to be addressed throughout the treatment cycle” (Canadian Association of Social Workers, n.d.1). If you haven’t noticed, CASW’s Code of Ethics align with PIPEDA’s principles with respect to maintaining privacy and confidentiality. So, when it comes to privacy and confidentiality, they may be different terms, but they are actually very similar in nature. And so, the Canadian Association of Social Workers, definition of confidentiality, and PIPEDA’s definition of privacy, very much overlap.

Maintaining Confidentiality on Social Media

So, with respect to maintaining confidentiality on social media. There’s three areas that I’ll discuss in this episode. One, marketing social media posts. Two, posts asking for client referrals, and posts seeking advice for client related situations. Each of these have their own considerations when it comes to using social media. So now I’m going to dive into these three concepts.

Marketing and Confidentiality

So, let’s first discuss maintaining confidentiality when it comes to marketing your product practice. One of the most utilized marketing strategies in the business world is sharing client related stories or testimonials. And for this reason, many marketing professionals that you might hire might not be familiar with the therapist code of ethics and standards of practice when it relates to this. And as a result, marketing professionals might even tell you to share client related stories or testimonials in order to boost your relatability with perspective clients. However, although these might be strategies that are effective and appropriate for some businesses, they are typically not appropriate for therapy related services.

With testimonials, according to the Canadian Association of Social Workers, “registered social workers are generally not allowed to solicit or accept testimonials from past or current clients from direct counseling practice.” (Canadian Association of Social Workers, n.d.2). However, according to the same article on the CASW website, it differentiates that testimonials from counseling clients are different than workshop participants or other social workers. They even provide steps on how to gain testimonials in these specific circumstances, which you can read in the article that I have linked in the show notes. In saying this, this also depends on your regulatory body and standards of practice. There may be additional requirements laid out for you when it comes to your regulatory body. There are some regulatory bodies in Canada who have specific outline on how to use, or in some cases not use, testimonials in the standards of practice. And there are also some that do not reference testimonials at all. So, it’s important to best understand what’s expected for you in your particular circumstance with your regulatory body. As well as apply your own ethical judgment when deciding to solicit testimonials for the purpose of marketing your practice.

With sharing client related stories, this should always be weighted with your code of ethics, because, again, generally providing client related stories could be considered a breach of confidentiality. A great way, though, to market your practice but not share specific client stories is to share your own stories or even common themes or situations you have come across when working with a particular client population. Because now you’re speaking more to the generality of who you work with instead of specific clients.

So, let’s say you work with clients experiencing workplace stress and burnout. You may share common symptoms, situations, or statements that client’s typically experience. And to add another special touch, you can even direct the post to a reader using “you” statements so that they resonate with your marketing post.

So, let me give you an example. Maybe I want to create a social media marketing campaign. In that campaign, I may say something like, “Do you find it difficult to wake up in the morning because you dread having to go to work each day?” And then I might say, “You’re not alone.” And then I might even go on into sharing why they are not alone in this situation. I may provide a statistic or other relevant information with respect to workplace stress and burnout. And I might even go into other greater details about maybe a story that I’ve experienced and then I would have a call to action at the end. See how this can be effective without actually breaching confidentiality because now in this situation you’re taking your experience from working with clients, specifically a population of clients, and now you’re providing this marketing post directed towards someone instead of actually telling someone story. A person is relating to this post now instead of you sharing a story about somebody else.

Another consideration with respect to marketing is when someone gives you a review of your services or business, say on either Facebook or Google business pages, some marketing professionals will tell you to respond to the reviews regardless if it is a positive or negative review, but this again could be considered a breach of a client’s confidentiality as you are now confirming that they have been a client with you.

For example, say your client is, let’s call them James, writes a review saying, ” I recommend Kayla as a therapist as she has helped me through my depression.” And then I might respond saying, “Thanks, James. It’s been great working with you.” or maybe I even just say, “Thanks, James.” In the first statement, I would be directly confirming that I’ve worked with James because I would be saying, it’s been great working with you. Even in the second statement, although I just say “Thanks James”, it would still be confirming that I worked with him, because I’m thanking him for his review. So when it comes to reviews, it’s important not to respond to them. It’s important not to respond to them, even if they are negative.

And unfortunately, in the cyber world today, there are instances where people, or even bots, who of course you’ve never worked with, will leave a negative review for you. I see this question come up time and time again in social media groups whether they should respond to it because it’s not actually a client. Like I said in the introduction, I am not providing any legal or regulatory advice here because, well, I’m not a lawyer. But in my opinion, and if it were me, even if it isn’t a client leaving a review, I still wouldn’t respond without legal advice before doing so. In some cases, you might be able to remove or hide the review from public view, that’s best-case scenario. But in cases that you cannot get it removed, it may have to stay there. This can be disheartening, but recognize that someone’s review of your services, fake or otherwise, is not a reflection of your work or practice. In the case of an actual client leaving a review, it might just mean that it wasn’t the right service or type of approach for them. And that’s okay. Not everyone likes or aligns with every approach or every therapist. And in the case of fake reviews, you know that it’s a fake review and definitely does not reflect your practice. Sometimes that can still be disheartening because you know that there’s a review out there that doesn’t necessarily reflect your practice, but unfortunately there’s not really a whole lot that you can do about that, and just continue to move forward in your practice and your marketing initiatives.

Seeking Referrals on Social Media

So now let’s move on to when you’re seeking referrals for a client using social media. Groups on social media can be a great way to find a therapist who specializes in a specific area so that you can build your referral network or find referrals for specific clients. However, again, how you write a social media post in a group matters when it comes to seeking a referral for specific clients in order to avoid breaching privacy and or confidentiality.

I’ve seen all types of referral requests in various online communities that range from asking for a general referral to providing way too much information about the client’s session or intake that probably wasn’t even necessary for obtaining an appropriate referral for that client. To help you avoid being on the latter end of the spectrum, let’s discuss an example.

Let’s say that you are seeking a referral for a client. Let’s call them Joan. Joan is a 40-year-old woman living in Edmonton who is experiencing PTSD due to being in a car accident where a loved one had tragically died. Joan came to you because she was experiencing nightmares and flashbacks of the event and she is struggling with anxiety of leaving the home in fear of being in another accident. And you’re seeking a referral because your practice is currently full.

So, a referral request that is probably providing too much and even unnecessary information may be something like this. Seeking a referral for a 40-year-old woman in Edmonton who is experiencing nightmares and flashbacks due to PTSD from an accident that led to the death of a loved one. Client is seeking support for managing fear with leaving the home. In this example, even though you’re not using the client’s name, you’re using a lot of information that had been gathered confidentially as a part of your session with the client.

In addition, to find an appropriate referral, you wouldn’t necessarily need to give as much information as that. In fact, a better way to ask for a referral is to reframe the question towards the skills and training of the therapist that you’re seeking and less about the client. Let me give an example of what I mean by this. You could say, seeking a therapist for a referral who specializes in PTSD and has training in trauma informed care. This way, you’re focused more on the generality instead of specifics, and you’re focusing on skills and training instead of providing specific client information.

Once you’ve gathered referrals, if the client wishes to work with one of these referred therapists, the referred therapist can either do their own consultation or intake to ensure that there’s an appropriate fit there. Or with the client’s written consent, you and the therapist could have a warm handover with the client. So this way, you’re still ensuring that it’s an appropriate fit. But you’re not going on social media about a client’s situation when you don’t need to.

Seeking Advice with Client-Related Situations

The third situation is when you’re seeking advice for a client related situation on social media. Really, in my opinion, these types of posts are almost always a breach of confidentiality or privacy, because there are very few ways to say the client related situation without divulging personal information, even if you don’t say the client’s name.

Even though social media is accessible, it shouldn’t be used as a replacement for clinical consultation with a clinical supervisor. And unfortunately, I think social media has kind of become a way to obtain free clinical supervision, but there’s so many risks associated with that. And specific client related situations or advice, in my opinion, is best reserved for discussions with your clinical supervisor, which ideally you have written consent in your intake forms when you’re connecting with clients, informing them that you might seek clinical supervision at any time with respect to your practice. And inform them of what might or might not be shared with your supervisor. So, this goes back to, when we talked about the Canadian Association of Social Workers providing informed consent, you’re giving them informed consent in your intake forms of connecting with a clinical supervisor, you have told them about this, they have agreed to this, they understand this, and you’re providing that information.

Now if you’re seeking resources instead of specific client situations, there are certainly ways to ask without even discussing the client information at all. So, let’s go back to the example of Joan. Maybe you want to find resources to support Joan with managing PDSD and fear of leaving the home. You might just simply ask the question, does anyone have any resources such as books, podcasts, or worksheets to help manage PTSD or agoraphobia? In other words, fear of leaving the house. Again, you’re asking in generality instead of specifics, so you’re not giving personal information, but you’re still asking for that support.

Another important consideration, which I’m not sure most people know about actually, especially if you’ve never ran a Facebook group before. If you’re in a Facebook group and you choose to create a post and then you click anonymous hoping that no one ever knows it’s you. Your post is actually not anonymous because any group administrator of that group can actually see who’s posting. So, when I run my group, Boosting Business: Therapists Private Practice Community, I can see, any anonymous post, who the poster is. Sometimes we think if we’re anonymous, no one will ever know, but that isn’t really the case. And whether the administrator has to approve the post, or the administrator tries to delete the post, your profile appears, so we can always tell who it is. And sometimes, people even try to block administrators so that they think that they won’t be able to even see the anonymous post. But again, when it comes to social media posts, if you block an administrator, they can see that you blocked them, but they can still see who posted what, and they can remove you from the group. And this is so that, the administrators of a group can efficiently and accurately monitor and manage the group. So, Facebook does provide that autonomy to group administrators, so whether you choose to click an anonymous post or maybe even take the additional step to block an administrator, they can still see your post, they can still see that it’s you, so it’s not really anonymous.

And even if it were truly anonymous, which it isn’t, I would also wonder what a client would think if they saw a post that they even thought might be their therapist writing about them. Although we think that Facebook groups for therapists are only for therapists and that our clients will never be in these groups. This isn’t always the case because anyone can join a group as long as the administrator approves the request. And if the group is not set to private, anyone can see the post inside the group, even if they’re not even a part of the group.

Actually, since late 2023, I’ve even noticed that public groups, so Facebook groups that are not marked private by administrators, actually show up in news feeds as suggestions for other people to join. So, if you’re posting in a group that isn’t private, your post may even show up on the client’s or someone that knows the client’s news feed. And even if you’re anonymous, it doesn’t mean that someone won’t notice or identify the information you’re sharing about them.

Another example too is even if it was just other therapists in the group with you. It doesn’t mean that the client hasn’t worked with other therapists in the past. And really, you’re putting all this information out there. That other therapists might even be able to identify who that client is. And even though, yes, they’re therapists, it’s still, in my opinion, a potential breach of confidentiality because now a therapist that no longer works with a client is seeing information about this client. So, like I said, if you have a client related situation arise, that you need advice or support with, the best person to help you would be your clinical supervisor, not social media. If you are working in an agency or a group practice setting, you may have an easier time accessing supervision. However, if you’re a private practice owner, you may have to pay out of pocket for this, and I think this is why people tend to go to social media to get free consultation. But at the end of the day, it’s really not worth it.

PIPEDA, Ethics and Social Media

Bringing these concepts back to PIPEDA principles and CASW’s codes of ethics that we discussed earlier in this episode, from my interpretation, posting client related information on social media is a privacy law violation and an ethical concern because the personal information collected from a client in therapy sessions is being disclosed under circumstances other than the purpose for which it was intended. In addition, the client’s right to confidentiality in this context would be disregarded because now it’s shared publicly, even if their name isn’t attached. And I think this is where sometimes we think, “Oh, if I don’t say the client’s name, it’s fine.” Or “if I don’t share my name, it’s fine.” But, again, as we went back to what personal information is, it’s not just the name.


So, as we discussed, there are ways around obtaining the information you need without having disclosed client information online such as:

When it comes to marketing your practice, you can use your own stories or provide common themes or situations you see when working with populations overall, instead of giving specific client information.

With seeking referrals, ask for specific therapist skills or trainings that you know would be best aligned with the needs of the client instead of posting about the client themselves, and then when the referral is provided to the client, the referred therapist can conduct the consultation to ensure best fit, or with consent, you can provide a warm handover with the client.

And when it comes to seeking advice for specific client situations, best practice is to seek consultation from a clinical supervisor opposed to seeking advice online. However, like we said, if you’re seeking resources to support a client, using social media can be helpful to find these resources. But instead of providing client information, you can make a general request for resources on a specific topic or approach that again you know would benefit the client in other words asking does anyone have resources on x topic

So, I hope that today’s episode helped provide some clarity regarding how to use social media in your practice while maintaining your client’s confidentiality, your professional integrity, and potentially protecting your professional registration or license from a regulatory board complaint.

Thank you for tuning in to today’s episode and if you like this episode or the designer practice podcast as a whole, I would really appreciate if you would share the podcast with a colleague or with someone in your community so that other therapists can tune in as well.

Until next time. Bye for now.

Podcast Links

Free Boosting Business Community: facebook.com/groups/exclusiveprivatepracticecommunity

Online Legal Essentials Legal Templates: kayladas.com/onlinelegalessentials

Use coupon code EVASPARE10 to receive 10% off any legal template pack

PESI Trainings: kayladas.com/pesi

Credits & Disclaimers

Music by ItsWatR from Pixabay

The Designer Practice Podcast and Evaspare Inc. has an affiliate and/or sponsorship relationship for advertisements in our podcast episodes. We receive commission or monetary compensation, at no extra cost to you, when you use our promotional codes and/or check out advertisement links.


Canadian Association of Social Workers. (2005) Code of Ethics. Retrieved from https://www.casw-acts.ca/files/attachements/casw_code_of_ethics_0.pdf

Canadian Association of Social Workers. (n.d.1). 5.1.1 Confidentiality. Retrieved from https://www.casw-acts.ca/en/511-confidentiality

Canadian Association of Social Workers. (n.d.2). 4.2.1 Testimonials. Retrieved from https://www.casw-acts.ca/en/421-testimonials

Office of the Privacy Commissioner of Canada. (2004, November). Questions and answers regarding the application of PIPEDA, Alberta and British Columbia’s Personal Information Protection Acts. Retrieved from https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/

Office of the Privacy Commissioner of Canada. (2018, January). PIPEDA legislation and related regulations. Retrieved from https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/

Office of the Privacy Commissioner of Canada. (2019, May). PIPEDA in brief. Retrieved from https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/

Pin It on Pinterest

Share This