Practice mechanics that support your well-being

Successful psychologists agree: Readiness is an important form of self-care. Investing time to protect your practice from cybercrime, fluctuations in revenue, and unexpected events isn’t the way people normally label self-care, but are core to that pursuit.

“Some therapists think of tasks like marketing as selfish, but making sure you have financial stability allows you to better serve patients because you are not worrying about the rent or next student loan when your income is consistent,” instead of focusing on your patient said Daniel Wendler, PsyD, who uses his own team’s search engine optimization and Google Ads services as founder of Marketing for Therapistsopens in new window. “If you make it a habit to invest in these tasks, you can be more present as a clinician and in life in general.” Here are some ways to do that:

The Change Healthcare data breach in February 2024 highlighted the importance of good cyber hygiene when data from more than 190 million patients was stolen after hackers gained unauthorized access to the company’s data through a portal that did not have multifactor authentication enabled. Change, which serves as a middleman between providers’ electronic health records and health insurance plans, processes billions of claim submissions, provider payments, and other information each year. After the hack, for weeks many psychologists did not receive payments from insurance companies and they struggled to pay employees, rent, and other expenses. Practice owners often shielded their staff and patients from this financial instability, which meant they were bearing significant levels of stress as they waited for a resolution.

While the Change ransomware attack affected a wide range of medical and behavioral providers, one of the most notable data breaches targeting mental health clinicians made headlines in 2020 when someone hacked more than 30,000 patient records at Vastaamo, a psychotherapy provider with 20 clinics and 400 employees in Finland. The hacker sought ransom from patients for highly sensitive information, and these people became vulnerable to identity theft.

Learning about cybersecurity can feel overwhelming, but approaching this ongoing defense in small, manageable steps can reduce your risk of a nerve-racking data breach. “The first step is to get the blinders off that this will not happen to your practice,” said Alexandra J. S. Fouracres, CPsychol, a psychologist and a cybersecurity consultant. Getting started is “easier than you think,” she said. She encourages therapists to begin by evaluating their defenses and pinpointing their weaknesses. “Most people know what they are if they start thinking about it,” she said.

For example, if your passwords are stored on a document on your device, an alternative is to get a protected digital password manager to safely store usernames and passwords, and use different, strong passwords. Practitioners should also consider scheduling regular reminders to review which files they can delete because storing them longer than needed increases risk. State retention periods can vary, so it is wise to check state requirements for how long files must be stored.

Up-to-date security software for your computer is another important layer of protection, and “if you have used the same product for years, it might be time to switch,” Fouracres said. When researching computer software security products, ensure they have real-time ransomware protection, and use the trial period to confirm you are comfortable using it. Once the software is installed, complete updates whenever they are available because these have been implemented to provide increased coverage and fill any weaknesses in the product.

Therapists who offer telehealth visits should select a HIPAA-compliant platform that includes end-to-end encryption and multifactor authentication, said Allison Funicelli, assistant vice president of the risk management group at AWAC Services Company, a member company of Allied World (Allied World is the insurance carrier for the American Professional Agency, which provides professional liability insurance to APA members). Be sure the vendor’s platform provides a business associate agreement, which is designed to ensure the vendor complies with HIPAA standards to protect the patients’ personal health information.

It’s also critical to consider cybersecurity when using AI in a clinical setting. Funicelli encourages clinicians to make sure their AI platform is HIPAA-compliant and find out how frequently the data—such as patient notes from a recorded session—is purged. The individual provider should be the only person who can access the sensitive information, she said. The AI-generated recording of the session should be purged as soon as a transcript of the recording is created and downloaded, preferably within 24–48 hours after the session. It is important for an office practice or organization to create standard policies and procedures related to the use of AI in compliance with state and federal guidelines, Funicelli said. To help practitioners safely integrate these tools into their practices, APA also recently published the Ethical Guidance for AI in the Professional Practice of Health Service Psychology. Funicelli also recommends ensuring data is backed up regularly. Practitioners who are using a third-party platform should learn how often and where the data is backed up.

An additional layer of protection is having cyberinsurance, which costs around $40 per month and covers expenses related to data compromise from a cyberattack, cyber extortion, misdirected payment fraud, and more. Take time to read the terms and conditions of the policy, which often require practitioners to maintain certain security standards. This could include requirements related to firewalls, software updates, and how often data is deleted. The policy outlines what is covered, and knowledgeable insurance brokers can explain the terms and conditions.

Fouracres also recommends drafting a detailed plan for what to do and how to recover from a cyberattack, with such details as how to get your devices offline quickly, who to contact from the cyberinsurance team, how to report the attack to authorities, and how to communicate about the breach with patients. Recovery should also include removing any potential malware, accessing backup files with important information, and improving cybersecurity to prevent future attacks. “The more layers you have, the better your chances are of stopping someone,” she said.

Wendler, who worked in digital marketing before pursuing psychology, was in graduate school when he realized the fear many psychologists felt about building and maintaining a successful clinical practice. He talked to a fellow student who was terrified about the marketing involved in opening a practice, which prompted Wedler to start helping psychologists with website design, social media management, Google ads, and more. Finding sustainable routines to invest in marketing can increase the chances of stable and growing revenue.

To quell first-timers’ fears, he encourages practitioners to focus on a marketing strategy that they enjoy and that feels authentic and comfortable rather than forcing themselves to attract new patients using techniques that feel stressful or distasteful to them. “If a clinician does not like digital marketing, find another strategy that works,” he said. “There is no ‘right’ way to market.” Wendler enjoys helping people solve problems for free through his website, YouTube channel, and books he has authored. As a neurodivergent psychologist, he shares about topics such as “How to use your autistic special interest to grow” and “How to connect better with others through curiosity” on his YouTubeopens in new window channel. “By showing people that you can help them solve a problem, you build trust and increase the odds that patients will seek you out for therapy,” Wendler said.

Websites, social media posts, and videos that focus on the benefits the clinician can offer patients are more likely to connect with potential patients than listing credentials, certifications, and a therapeutic orientation. “Most people have no idea what these qualifications mean,” Wendler said. Describing outcomes for the patient is more effective, such as “You will be able to confront parts of yourself you have been afraid of” or “You will be able to speak to your partner in a way that you can understand one another.”

Wendler also recommends that therapists create a short (60–90 seconds) introductory video for their website for potential patients to view. In the video, focus on how the therapist will help the viewer and answer the biggest questions that you think the patient will have as they browse the website, such as “How can therapy help me with this problem?” or “Is my problem serious enough for therapy?”

Clinicians in private practice can also protect themselves financially by investing in disability insurance. In the event of an illness or accident, this type of insurance provides monthly payouts based on the policy purchased. Short-term disability insurance provides a portion of an individual’s income for 3 to 6 months, while long-term disability insurance can last for years or until retirement. “You don’t get paid leave in private practice,” said Robyn Miller, PhD, a psychologist in Maryland who maintains disability insurance to safeguard against unforeseen circumstances. “If something happens, you want to protect yourself and your family so you can recover from an illness without the stress of financial hardship.”

Rhode Island attorney Leah Small has worked with clients who are eligible for disability insurance benefits due to cancer, multiple sclerosis, Parkinson’s disease, orthopedic issues, mental illness, fibromyalgia, or other health conditions. These policies usually clearly outline eligibility requirements, documentation, deadlines, and other claim details, she said, but the claim forms often leave little room to explain an illness or injury. Small advises using attachments to fully describe the condition and its impact on work or patient care.

Another responsibility that can weigh on psychologists is preparing a professional will that outlines their wishes for closing a practice in the event of illness or death. “There are many clinicians who tell me they have wanted to create a will, but they got stuck at one step or another,” said Miller, PhD, who founded TheraClosureopens in new window in 2024, a company that helps therapists create a professional will and serves as the practice executor in the event the therapist dies. Clinicians may feel overwhelmed describing the details of the practice or not know who to ask to fill the role of practice executor to carry out their instructions.

Psychologists can work with a lawyer, colleagues, or TheraClosure to plan who will contact patients, how to protect patient confidentiality, where to find passwords to access patient records, and other details. By preparing this information in advance, clinicians are protecting the well-being of their patients and family members. “Patients tend to feel angry or abandoned if the person they relied on did not have any system in place to look after them,” Miller said. “Family can be left with legal and ethical responsibilities they do not understand.” At a time when they are acutely grieving.

Professional wills also give psychologists the freedom to focus on their own needs if they are facing a serious illness. When Miller’s friend—also a psychologist—was diagnosed with Stage IV cancer several years ago, her friend was grappling with failing health, grief, and the needs of her family. Her friend found comfort in being able to hand off care for her patients to Miller, who stepped up as practice executor.

“In the event of a life-threatening emergency, it is priceless to have the freedom to focus on your health and family rather than worrying about your practice and patients,” said Miller.

While it’s easy to feel overwhelmed by the behind-the-scenes tasks of managing a practice, she and others advise focusing on what feels most pressing or doable, remembering that taking care of your practice is taking care of yourself, and any progress is a meaningful act of self-care.