Is Your Online Therapy Safe?

Online mental health services in Malaysia have boomed since the pandemic, but guidelines concerning patient security and data privacy need to be monitored.

Asian Scientist Magazine (Nov. 8, 2022) — Mental Health consultations are just one of the many aspects of our lives, including remote working and fitness classes, which have been heavily digitalized since the start of the COVID-19 pandemic. Therapists and clinical psychiatrists are increasingly using apps or video conference platforms such as Zoom and even WhatsApp to conduct remote consultations and therapy sessions with clients looking for support in a safe space. Widespread use of such platforms has allowed people to easily seek mental healthcare online.

“There are more people who are interested in having online sessions because it’s easier for them,” Mimie Rahman, a counselor based in Petaling Jaya, Malaysia, told Asian Scientist Magazine.

Lower cost compared to in-person sessions coupled with the ability to have the sessions anytime and anywhere is a major factor behind this increased demand for online teletherapy.

“In a month I usually see around 20–30 clients. Around 60 percent of them are online. Only 40 percent are face-to-face,” said Mimie.

She also noticed a marked increase in the number of clients since the start of her training in 2021 during the height of Malaysia’s third wave of COVID-19. At one point she received almost a hundred client requests in a month. However, as the popularity of online counseling increases, there is a growing concern regarding data protection and patient security. Zoom had previously come under fire for its poor end-to-end encryption in 2020, leading to situations where meetings were hijacked by malicious users playing or sending shocking material as a prank. User emails and passwords were also leaked.

Data security and protection is extremely important in the healthcare sector and especially so for mental health services. A client’s family history, medical records, and in some cases, intimate details about their trauma and self-harm are important information a therapist needs in order to understand and help their client in managing their mental wellbeing. Sharing this information involves a huge level of trust that is integral for a mutually beneficial outcome for the client and the therapist.

With this in mind, institutions like the American Psychological Association (APA) have updated their code of ethics to include guidelines for psychologists and therapists in selecting and using appropriate digital platforms to ensure patient confidentiality and data protection. In a section outlining data and information confidentiality, the APA suggests consulting with technology experts before initiating any online teletherapy sessions to create and apply security measures, along with suggested criteria for finding applications or methods ensuring a minimal chance of breaches.

In Malaysia, however, the absence of clear-cut guidelines leave mental healthcare providers to figure out for themselves the rules and regulations needed to protect patient data during teletherapy sessions. For mental healthcare workers like Mimie, it has been a complicated situation to navigate. According to her, the situation has become confusing because of the lack of clear communication from Malaysia’s Ministry of Health regarding any updates to guidelines surrounding telemedicine in the country. Asian Scientist Magazine reached out to the ministry seeking an interview to understand its plans to make online mental health services safer but received no response.


The Doctor Will See You Online 

Remote healthcare has been around since the 1920s. Physicians and specialists sent clinical information to each other using telephone lines and radio. Closed-circuit television and eventually video conferencing technology in the 1970s led to the development of remote healthcare monitoring and delivery to patients in rural areas. With today’s technology, doctors and patients can contact each other through a single swipe on a smartphone.

In Malaysia, the Telemedicine Act has been in place since 1997 as part of the country’s national blueprint to strengthen healthcare delivery in the public sector through telecommunications and information technology. However, the Act itself has not been updated since then, with many of the clauses reflecting an old understanding of the tech that was available at that time. The law is a short, three-page document detailing how patient consent must be obtained and how physical files and images must be kept securely by doctors and nurses. The law doesn’t specifically talk about mental healthcare workers such as therapists and clinical psychologists, and neither does it detail how to protect sensitive patient data using digital communication services including video conferencing apps.

In a paper published in 2020 reviewing the telemedicine guidelines in Southeast Asia, lead author Dr. Intan Sabrina Mohammad explained that a majority of the guidelines in the region, including Malaysia, do not directly govern the technology or platforms used for telemedicine or remote healthcare. Intan is a rehabilitation physician at Hospital Rehabilitasi Cheras in Kuala Lumpur. In mid-2020, Malaysia’s health ministry published a ‘virtual clinic’ guideline for doctors to conduct consultations, make diagnoses and carry out preventive care by using video conferencing apps remotely. However, the guideline did not provide clear examples of video conference platforms that were approved, nor explicit instructions on how to best manage patient data. And, again the document did not include therapists, clinical psychologists and other healthcare workers.


Convenience Over Confidentiality 

Fiqa Abdul Fata, a wellness coach and clinical psychologist conducted in-person hospital rotations in the northern peninsular state of Perak and the east coast peninsular state of Kelantan from the start of the pandemic up until September 2021. According to her, there were no concrete guidelines set by the psychiatry department she was placed in regarding suitable platforms for conducting online teletherapy sessions.

“For video sessions, I will say there was no particular guideline, to be honest. We were going into it blindly,” Fiqa told Asian Scientist Magazine.

Patients under her care would sometimes struggle with using video conferencing apps such as Zoom, due to poor internet connection or a lack of understanding of how such platforms worked. Cycling through various platforms and apps in the hope that something would stick, they eventually settled on an app that was “most convenient for the patient to use.” When Mimie first began her training, she too opted to use the most convenient app or platform for her online sessions. But easy-to-use apps may not always be the safest.

Now Mimie uses dedicated teletherapy apps that have been approved by the health centers where she carries out her work. Having used these platforms with end-to-end encryption to conduct her therapy sessions, Mimie said she is more aware of the risks associated with public apps and unsecured platforms.

Mimie and Fiqa hope that Malaysia’s health ministry will look into providing clearer guidelines on virtual health clinics that underscore the safety of both the patients and service providers. Protecting patient data is crucial for trust to develop between a patient and the healthcare worker. Without trust, mental healthcare practitioners can’t help the patient navigate their way in learning about and managing their mental health.


This article was first published in the print version of Asian Scientist Magazine, July 2022.
Click here to subscribe to Asian Scientist Magazine in print.

Copyright: Asian Scientist Magazine. Illustration: Ajun Chuah /Asian Scientist Magazine

Hannan is a science writer with an interest in telling stories about science and the people behind it. She graduated with a degree in biochemistry from the University of Nottingham.

Related Stories from Asian Scientist