386: Cyber Security for Counsellors

Counselling Tutor podcast

Episode 386 of the Counselling Tutor Podcast addresses three core areas for practitioners: digital security risks in private practice, ethical person-centred counselling for clients living with

Key takeaways

• Cyber attacks on therapy practices are escalating, exemplified by a 2020 Finnish company hack affecting 33,000 clients, making cyber insurance and strict data protocols essential.
• Danuta Lipinska stresses that dementia is not an immediate end to therapeutic engagement; practitioners should maintain person-centred core conditions like empathy and congruence throughout cognitive decline.

Main topics

• Cyber security and data breach prevention
• Counselling clients with dementia or cognitive impairment

Notable quotes

"Don't believe the truth. Stop and think."

Conclusion

The episode equips counsellors with concrete steps to safeguard their

Transcript preview

Speaker 2 (0:00) As a qualified practitioner, you'll know that our understanding of autism is ever-evolving. More autistic clients are coming into the therapy room and people are actively looking for a therapist who understands neurodivergence. Counseling Tutor's Autism Informed Practice Training is a 45-hour CPD qualification built by a neurodivergent team. A balance of self-directed learning and an intimate live workshop where the theory comes to life. Download your free handbook at counsellingtutor.com, click products and select autism informed practice. Speaker 1 (0:43) Hello and welcome to episode 386 of the Counselling Tutor Podcast. I'm Rory and my guest today is Danuta Lipenska, who has more than 30 years experience of working in the community with people living with dementia and those who care for them. Danuta holds a BA in Psychology and an MA in Counselling. both from the University of New Hampshire in the United States. And during her long and varied career, she has worked as a qualified nurse, director of nursing in a residential care home, a director of elderly services within a community counselling service, and as a training consultant specialising in dementia care and ageing. Dinuta is a registered and accredited member of the British Association of Counselling and Psychotherapy. and the UKRC Association of Independent Practitioners. She has designed and delivered specialist counselling services for people living with dementia and their carers, and she continues to support this community through work as a counsellor and clinical supervisor. Today, Danuta joins me to discuss counselling people living with dementia and how therapists can offer sensitive, ethical... and genuine person-centered support so with that said let's roll the intro Speaker 3 (2:13) to the Counseling Tutor Podcast. the must-listen-to podcast for counselors, psychotherapists, and counseling students. Speaker 3 (2:24) Here are your hosts, Rory Lees-Oaks and Ken Kelly. Speaker 2 (2:29) Hello and a very warm welcome to episode 386 of the Counselling Tutor Podcast with Rory Lees-Oaks and Ken Kelly. Rory and I taking you through three stops on our journey today, starting off with ethical sustainable practice, where we're Speaker 4 (2:45) going Speaker 2 (2:45) to discuss what would happen if your counselling practice got hacked. a shiver as I just think of that topic Rory and then we move on to practice matters Rory has beautifully teed that up already and a really interesting topic that we're going to be discussing now and that's counselling those experiencing dementia we then move into student services recognising students on the formal journey to become counsellors psychotherapists or to just gain some skills that you can use within other work and today how do I bring counselling theory and the client together. This is an evergreen topic. So we're going to be digging deep on that. And I think if you're not a student, this is still going to apply to you. But let's start, Rory, with ethical sustainable practice and a horrible topic. What if your counseling practice was hacked? And just to kind of lay a doormat into this. You know, why do we have these kind of discussions and why do we say these things? And Rory will fill us in as we kind of go along. But a couple of interesting things have come up in our world that have made us look at this a little bit more closely. And I'm very mindful that AI is in the news a lot lately and specifically AI's ability to hack institutions. Just yesterday, the Australian health... website was hacked by one of OpenAI's agents. So this is happening more and more and more. And I guess it's just something that we've got to think about. So we're not the experts, but we are two colleagues having this discussion. Over to you, Rory. What's your thoughts? Speaker 1 (4:29) Well, my thoughts is we don't want to be scaring people. We don't want to be telling people scary stories to keep them awake at night. Nor is Counselling Tutor a red-top newspaper. that posts salacious news items to frighten people and get attention. However, the fact of the matter is, is that cyber attacks are happening. Manchester airport near where I live has been hacked. Police database has been hacked. The health records have been hacked. This is now not becoming something that happens every so many years. This is something that's happening every so many months. by the sound of it and i think what's more worrying is there's a precedent for this in 2020 vastamo i hope i'm pronouncing that correctly a large psychotherapy company in finland was hacked and the attacker gained access to confidential therapy notes of around and wait for this ken 33 000 people Speaker 2 (5:30) 33 Speaker 1 (5:31) 000. that's 33 000 clients I mean, that's a football stadium. That's a football stadium perspective. That's a football stadium. And when the company refused to pay a ransom, the attacker contacted the clients directly and threatened to publish their therapy notes and personal information. And the BBC reported at least one person took their own life linked to the case. Yeah. And lots of people, lots of victims. relapsed in their mental health and it was six years later where the idiot who did this um was um arrested and he got six six years you know criminal justice system six years he got in prison and the company the company went into receivership now this is an extreme case however you know you look at our facebook group people are storing their You know, their client's details on mobile phones, they're putting their details on memory sticks. Nothing wrong with that on their computer. But what happens if you have a break-in or you lose your computer? Or, you know, I know a lot of computers are shared by families and some member of the family accidentally shares some data or emails it. This is a real issue. And I think that taking the attitude, well, no one's going to hack me. No one knows who I am. Probably isn't the best position to be in. And also things like phishing emails. We get hundreds of them at Counseling Tutor. Very convincing emails. Click this link. And what they're trying to do is get access to our IT. You know, a compromised cloud account. Speaker 1 (7:30) Also, sending confidential information to the wrong person. You know, you have so many people in your address book, on your email, client contacts you. You say, oh, I'll send that information. You send it and you realise you have two people with the same name. And that then becomes a professional and ethical issue. So what do we do, Ken? What do we do in this situation? And more to the point, how do we protect ourselves? because we're living in a more contagious society, aren't we? Speaker 2 (8:01) We are, and we're speaking about protecting ourselves and our practice and, of course, our clients. And I like how you kind of framed that up, Rory, by saying, well, nobody's really going to hack me. One of the things we see quite a lot in counseling tutor are spam or phishing emails. So it's a PH for phishing, like slight phishing, really. And it's a scam where a really legitimate looking email might land in your inbox and it might ask you to click on a link to check something, update something, get something, confirm something. it will look legitimate. It will look like from one of the providers that you use and that you trust. It might look like it comes from your bank, for example. But what these emails do is they gather information. As soon as you click on them, as soon as you're clicking on something in an email, you basically can be activating something that might download to your computer. or might take you to a page that has got scripts on it that can affect how your browser works and it can download things onto your system. And at the spiky end of this, they can gain access to something like your Gmail account. If you're using something like that for your practice where you're mailing out, so all of your client records there or any... correspondence you've had is there and we see often in counseling tutor because lots of people join up with counseling tutor and when they do so they're saying here's my email address so we can keep you updated and we start getting emails from counselors with a counseling email address that are very clearly phishing emails and it's an indicator that that counsellor's account has been compromised and they're probably unaware of it because what happens is they tend to kind of send out more phishing emails to those on your contact list and that can include your clients. So it does happen. It is happening. There's no need, as Rory says, to be fearful of this and basic cyber security. learning how to protect yourself, learning not to click on links that look strange. If you get an email from your bank, rather than clicking on the link in the email, phone your bank or go on the website and go directly to your bank and see if there's a notification in there. There certainly will be. If they're sending you emails, there would be a notification. Same is true of texts. The same can be true of WhatsApp messages. So there's many different ways that cyber criminals... are trying to access people's accounts. And they might not be trying to access you because you're a therapist. They just want to get onto people's computers. They can put little bits of code on computers that watch what you do, watch what you log into, watches your keystrokes, and it becomes invisible. You don't see it. Again, it's not a horror story. It's just a reality of the world that we live in. And with the news, more and more. of this kind of thing is happening. There's some bad actors out there. They're using AI and clever agents to do this work. So we're going to see more and more of it. You may come across clients that have experienced this. It really does shake your whole life if something has been accessed without your permission. But we're focusing today on you, your practice, and what you can do about it. And one of the things that you can do... is you can take out cyber insurance. If you go to your insurer who insures your practice and ask them about cyber insurance, what happens if some of my data gets taken? Because if you think about hacking as theft, they're coming in digitally and stealing your stuff that you are holding on behalf of someone else. Because we are... data controllers under the law. What do we mean by that? Well, the client is giving us their data, their information, and we've got to control how that is held, where it is held, all of that kind of stuff. We do have a duty. And like you said, Rory, and it doesn't happen often here in the UK, maybe more outside of the UK, but litigious, I can't say the word, people taking you to court, you know, if a client's details did get out, what might that look like? Could there be a case? Could they be looking for compensation for the harm that they have faced through this? Speaker 2 (12:50) And yeah, so it's something to think about. So like I say, if you speak to your insurer, you can ask them about cyber insurance. It shouldn't be too expensive for an individual practitioner. And it's something we didn't have to think about before. But boy, is the age that we live in changing, Rory. It's just getting weirder and weirder and weirder. And I think it all starts with having... Speaker 2 (13:18) thinking critically about what we do in our inbox, on our WhatsApp, and in any area that messages. I think you've put in the handout, stop and think. Speaker 1 (13:30) Yes, stop and think. Don't believe the truth. Speaker 2 (13:34) Exactly. We have regular training on this in Counselling Tutor. We've got a team that trains us on cyber security and what happens. And we get some really convincing emails through, don't we, Rory, that look just the ticket. I could tell you a Speaker 1 (13:51) story about one, actually, Ken. I got one literally the other day from someone who was saying, I've got a proposal. for you and it came from a care home and on the face of it it looked really really convincing but I've been on this rodeo before and I looked at it and I thought I'm a very much of a great believer in don't believe the truth so I looked at it and I thought hmm yeah I've seen these before because they tend to be in a format so I phoned up the care home spoke to this lovely woman she said I said, I think your email has been hacked. She said, oh, I tear on it now. You're the fifth person who's contacted me today. Speaker 2 (14:34) I wonder how many people were emailed and only five people realized and phoned in. I wonder how many people actually clicked on those links. So, yeah, we have a thing in our company. We never click. on an external link anymore. We just don't do it. You just can't in this day. Even if you're receiving an email from somebody that you trust, it's just the way it is these days. So the stop and think is about stopping and thinking now and thinking, how might you manage this? Speaker 2 (15:08) How if if if if something happened, who would you contact? So when you contacted the care home, Rory, they said, oh, we've spoken to our IT department. I bet there's very few listening to this unless you work in an agency that have got an IT department. I certainly didn't have an IT department in my in my practice, Rory. So it would be who can you contact? And when you hold insurance, obviously, that's going to be a a. place to contact. But the other place that we need to contact if there is a data breach is our clients. They need to be the first to know. When we know, they need to know. And often I've seen messages going out saying, hey, my email or my Facebook's been hacked or something's been hacked. Don't click on any emails that are coming in from me at the moment. I'll let you know when those are done. Speaker 2 (15:59) And then what would your professional responsibilities be in that kind of a situation? Speaker 1 (16:08) Yeah. Well, I think professional responsibilities start really with making sure that no more damage is done. So that might be something as simple as just turning off the Wi-Fi on your computer to make sure that no one externally can access it. And maybe thinking about, you know, running your virus scanner. Everybody should have a virus scanner on their computer or on their phone. Speaker 1 (16:36) If you think your computer's been hacked, maybe take your computer in to a shop and have it looked at. Also, I think that you should really be, if you believe that sensitive information has been leaked, and we're not talking about, you know, sending the wrong appointment details to a client here. We're talking about someone. accessing your computer where it becomes quite clear people may be contacting you and saying that's someone phone up said to you and they've got your details then I think what you need to do is if it's a serious breach contact the police contact speak with your ethical body and take a view there and of course if you're storing client data you should be a member if you're in the UK of the information commissioner's office which is the ICO and you should be paying the fee which you know people don't like paying fees i understand that but it is the law and you know then contact your insurance and i think if you've got insurance if you've got a good insurer they've been down this road before this won't be their first rodeo so they will be able to help you with things they may be able to um put you on to specialists so it's really really useful to speak with your insurer and say What can you do for me if this happens? Because it probably has happened and they probably dealt with it before. So forewarned is forearmed, as they say, Ken. I Speaker 2 (18:07) like that. Yeah, it is. And one of the things to consider as well is we've already said I'm just a lowly therapist. Nobody's going to bother hacking me. It might be a service that you use. So it could be a note-taking app. It could be your calendar that you use. It could be the email service that you use. So it could be a hack at a higher level than you sit at. And you might get a message from the app provider saying, oh, we're terribly sorry, but this has happened. And that might make you very cross. And maybe there is an opportunity for you to take action against that company. based in the UK. But if you look at the terms and conditions of these companies, many of them sit outside of the UK and work under the law where the actual company sits and where the service sits. So it can be really, really tricky. But it doesn't stop your clients taking action against you. Because you are the data controller, because you chose that tool and you... took your client's data and put it into that tool, which you would have done hopefully with informed consent, which is our UK GDPR law, we have a liability. We have a liability and a client can say, I don't care that it was XYZ app that got app. My stuff that I gave to you is now out there and I want compensation for