You don't need to be a tech expert to protect your patients' data, but if you need to take some basic precautions that most psychologists ignore.

The reality is that a psychological clinical practice is an attractive target for cyberattacks: it has sensitive mental health data, little security infrastructure and professionals who usually have no training in technology. A ransomware that encrypts your medical records or a passwordless notebook theft can be catastrophic.

In this article we give you a practical guide with everything you need to implement, ordered from more urgent to less urgent.

Why should a psychologist worry about cybersecurity?

Because you handle the most sensitive data that exist: mental health information. A patient entrusts to you his fears, traumas, diagnoses, medication, sexual orientation, suicidal ideas. If that information leaks:

For the patient: emotional damage, stigmatization, work discrimination, family problems
For you: legal liability (Ley 25.326), ethical sanctions, loss of professional confidence, claims for damages
For treatment: rupture of therapeutic alliance with all your patients if they find out

Note

You don’t need a sophisticated hacker. Most of the data leaks in clinical practice happen because of simple things: a notebook without a password, a backup on a lost pendrive, or an email sent to the wrong person.

The 10 essential measures

1. Secure passwords

It's the basics, but most of them fail here.

What should NOT be done:

Use the same password for everything
Use "123456", your date of birth or the name of your pet
Save passwords to a little paper attached to the monitor
Share passwords via WhatsApp

What IS TO BE done:

Use a password manager (Bitwarden is free and secure, 1Password is another good option)
Each account must have a single password
Passwords must have at least 12 characters with uppercase, lowercase, numbers and symbols
Change passwords if you suspect they were compromised

Critical passwords that should be strong:

Account	Why is it critical?
Professional Email	Access door to all other accounts (password recovery)
Clinical software	Direct access to medical records
Computer/notebook	Physical access to everything
Cloud (Google Drive, Dropbox)	If you keep clinical files there.
Bank / invoicing	Own and patient financial data

2 Two-step verification (2FA)

Two-step verification adds an extra layer of security. Even if someone discovers your password, they cannot enter without the second factor (usually a code on your cell phone).

Activate in:

Your professional email (Gmail, Outlook, etc.)
Your clinical software (if allowed)
Your bank account
Professional social networks

How to activate it?

In Gmail: Configuration → Security → Two-step verification
In most services: Configuration → Security → 2FA

Recommendation: Use an authentication app (Google Authenticator, Authy) instead of SMS. SMS can be intercepted.

3. Disk encryption

If someone steals your notebook or cell phone, the disk encryption makes the data unreadable without your password.

On Windows:

Find "BitLocker" in Settings → guides you step by step
On Windows 11 Home: Settings → Privacy & Security → Device Encryption

On Mac:

System Preferences → Security & Privacy → FileVault → Enable

On cell phone:

Android and iOS already come encrypted by default if you have PIN/password active
Verify: Configuration → Security → Encryption

Important

If your notebook does not have encryption enabled and you miss or steal it, anyone can access all your files simply by extracting the hard drive. No matter if you have Windows password — that only protects the login, not the data.

4. Backup of medical records

Losing medical records is a legal breach (Law 26.529, 10 years of conservation) and a clinical catastrophe.

Rule 3-2-1:

3 copies of your data
In 2 different media types
1 copy out of your clinical practice

Backup options:

Medium	Advantages	Disadvantages
Encrypted Cloud (Google Drive + Cryptomator)	Automatic, accessible, safe	Requires configuration
External disk	Simple, economical	It can be damaged, you have to remember
Clinical software with automatic backup	No effort, professional.	Supplier Dependencies

Frequency: If you keep digital records, daily (or automatic) backup. If you keep records on paper, periodic scanning.

5. Safe WiFi

WiFi from your clinical practice is a gateway to your network.

Basic measures:

Password WPA3 (or WPA2 at least). Never WEP
Password of at least 12 characters other than "consultory123"
Change your router password (the one that comes from factory is on the internet)
If you offer WiFi to patients, use a separate network (guest network)
Deactivate WPS (it's a known vulnerability)

Guest Network? Most modern routers allow you to create two networks: one for you (where your computer is) and one for guests (patients). So, even if someone connected to the guest network tries something, they cannot access your computer.

6. Software Updates

Updates are not just for new functions — fix security vulnerabilities. A outdated system is a vulnerable system.

I keep updated:

Operating system (Windows, macOS)
Browser (Chrome, Firefox, Safari)
Clinical software
Antivirus
Mobile Apps

Tip: Enable automatic updates. It's the easiest way to keep up to date.

7 Phishing: the most common deception

Phishing is an attack where someone pretends to be a reliable entity (bank, AFIP, Google, your health insurance) to steal your data.

How to detect it:

Signal	Example:
Artificial urgency	"Your account will be suspended in 24 hours"
Spell error	"Dear wearer, your cut..."
Suspicious sender	soporte@go0gle.com (with zero instead of "or")
Links that do not match	The text says "www.banco.com" but the link goes to another URL
Unexpected attachments	"Deputy Bill" from someone you don't know.
Request for sensitive data	"Enter your password to verify your account"

What to do if you suspect:

Do not click on any link
Do not download any attachments
Don't answer the email.
If it appears to be from your bank or other entity, contact them directly through their official channels

Council

If you have doubts about an email, search the sender's address on Google. If it is phishing, someone probably already reported it.

8 Ransomware: Digital Kidnapping

Ransomware is a type of malware that encrypts all your files and asks for a ransom (usually in cryptocurrencies) to return them to you.

How a computer gets infected:

Opening an infected email attachment
Downloading Pirate Software
Visiting malicious websites
Through infected pendrives

How to prevent it:

I kept a backup up to date (if you get encrypted, you'll restore the backup)
Do not open attachments from unknown senders
Don't download software from unofficial sites
Use updated antivirus
I kept the operating system up to date.

If you happen:

Unplug the internet computer immediately
Do not pay the ransom (do not guarantee that the data will be returned to you)
Contact a specialist technician
Restore from your backup
Report to the UFECI (Tax Unit Specialized in Cybercrime)

9. Cellular safety

Your cell phone probably has patient data: WhatsApp messages, calendars, document photos, professional email access.

Essential measures:

PIN or biometrics (print/face) activated
Encryption activated (comes by default in most modern cell phones)
Automatic locking after 1-2 minutes of inactivity
"Find My Device" function enabled (to remotely delete if you miss it)
Do not install apps from unknown sources
Check app permissions periodically

10. Physical security

Not everything is digital. Physical security remains important.

Clinical Paper Stories: kept under lock and key, not on the desktop
Notebook: not to leave it in the car, in the waiting room or in public places
screen: locks the screen (Windows + L, or Ctrl + Cmd + Q on Mac) when you wake up
Destruction of documents: Use paper shredder, do not throw clinical documents into the trash without destroying
Pendrive / external disk: saves in safe place, ideally encrypted

What to do if your notebook is stolen?

If your notebook has patient data and is stolen or lost:

Step 1: Act fast (first hours)

Try to locate the device remotely (Find my device on Windows / Find my Mac)
If you can't recover it, delete remotely the data
Change passwords for all the accounts you had logged in (email, clinical software, bank, networks)

Step 2: Assess damage

Was the disk encrypted? Yes → low risk. No → high risk
What information was there? Clinical records, patient data, sensitive documents?
Did you have a session with cloud services?

Step 3: Notify

If the data were not encrypted, you may be required to notify the affected patients and AAIP
Consult with a lawyer about your specific obligations
Make the police report (it serves as legal support)

Step 4: Document

Register in the medical records of each patient affected that there was a safety incident
Document what steps you took to mitigate the damage
Implement the missing measures so that it does not happen again

Important

If your notebook did not have secure disk encryption or password, and had medical records stored locally, it is considered a sensitive data breach. The legal consequences may be severe.

Safety Checklist for Your Clinical Practice

Print and verify:

Urgent (to do today)

Put strong password to computer
Enable two-step verification in the email
Enable disk encryption (BitLocker / FileVault)
Verify that the cell has PIN or biometrics

This week

Install a password manager and migrate passwords
Configure Auto Backup
Update operating system and browser
Change WiFi password if weak

This month

Create Guest Network for Patients WiFi
Enable "Find My Device" in the notebook and cell phone
Check which mobile apps have access to sensitive data
Training administrative staff on phishing

Recurrent maintenance

Update software (monthly)
Verify that backups work (quarterly)
Change critical passwords (annual or suspected breach)
Review accesses and permissions (monthly)

How Brauni solves cybersecurity for you

With Brauni, most of these concerns disappear because security is integrated into the platform:

End-to-end encryption: Your data is encrypted at rest and in transit — even if someone accesses the servers, they cannot read them
Auto-Backups: Don't remember to back up
Safe Access: Two-step verification available, automatic expiration sessions
No local data: Your medical records are not stored in your notebook — if stolen, your clinical data is safe in the cloud
Automatic Updates: The platform is always updated with the latest security patches
Access Log: You know exactly who agreed to what and when

Free Brauni test for 30 days, no card

Automatic session notes, digital medical records and more.

Start for free

Summary

Measure	Priority	Difficulty
Secure passwords + manager	Urgent	Easy
Two-step verification	Urgent	Easy
Disk encryption	Urgent	Average
Backup 3-2-1	High	Average
Safe WiFi + network guests	High	Average
Automatic updates	High	Easy
Recognize phishing	High	It requires practice.
Ransomware protection	High	Average
Cell phone security	Average	Easy
Physical security	Average	Easy

Cybersecurity for psychologists: how to protect your patients' data