WhatsApp with patients: limits, risks and good practices

If you attend patients, you use WhatsApp with them. It is practically inevitable: in Argentina it is the default channel for everything, and the use of WhatsApp with patients in psychology is not the exception. You coordinate appointments around, let us know if you are late, confirm the session on Thursday. So far, all reasonable.

The problem is that almost no psychologist thought of WhatsApp as part of the frame. He went in alone: first an appointment, then a brief consultation, then a seven-minute audio on a Sunday night counting the week. And one day you find yourself making chat interventions from your personal phone, without schedules, without rules and without registration.

The conclusion of this article is not "stop using WhatsApp". The tool is not the problem. The problem is to use it without rules. Here we show you the concrete risks, what professional ethics says and how to put together a use of WhatsApp that protects your patients, your practice and your rest.

What WhatsApp is for with patients (and why not)

The first decision is one of framing: to define what happens through that channel and what does not. Our recommendation is simple: WhatsApp is an administrative channel, not a clinical channel.

WHAT IS SUPPOSED TO BE DEFINED via WhatsApp

• Coordinate, confirm or reschedule appointments
• Timely warnings: delays, absences, holidays, changes in clinical practice
• Sessional reminders
• Payment issues: send the alias, confirm a transfer
• Share practical information: address, video call link, timetable

What's NOT going for WhatsApp

• Chat therapy: interpret, intervene, "work" a topic between sessions
• Clinical content of the patient: crisis reports, dreams, detailed family conflicts
• Long audios of the patient counting his week, waiting for return
• Reports, diagnoses or results of evaluations
• Discussion on the treatment of session space

The dividing line is easy to remember: if the content of the message should be left in the medical records, it is not a theme for WhatsApp. It is a topic for the session.

The risks of using WhatsApp with patients without rules

It is not about alarmism: these are concrete risks that we have already seen materialize in real clinical practices. We grouped them into three.

1 Confidentiality: Your personal phone is the weak link

WhatsApp encrypts end-to-end messages as they travel. The problem is not transit: it's all around your phone.

• Backups without encryption. By default, the backup of your chats can be uploaded to Google Drive or iCloud without end-to-end encryption. There are still years of patient conversations, accessible to anyone entering that account.
• The screen that displays messages. A notification that appears while you show something to another person, the phone supported on the table during a dinner, WhatsApp Web open on a shared computer. The patient's name and the start of the message are visible.
• Phone stolen or lost. If there is no strong and encrypted lock, whoever has access to all chats. And even if you do, the chip can be used to reactivate the account on another device if you did not activate the verification in two steps.

This is not just a technical problem: it is a legal problem. Mental health data are sensitive data according to Act 25.326 on Personal Data Protection, and you are responsible for protecting them with appropriate security measures. A clinical chat on a personal phone without encryption or blocking hardly qualifies as "appropriate measure".

2. Availability 24/7 and framing erosion

The second risk is not technological: it is clinical. WhatsApp generates an expectation of permanent availability that no treatment agreed.

The message of 2 AM. The double blue tilde that the patient interprets as "read me and does not answer me." Saturday's consultation that "is short." The feeling, for the patient, that the therapist is always there, and for you, that you never finish working.

When the channel has no rules, every quick response out of schedule reinforces the expectation of the next one. And each silence becomes interpretation material: are you angry? do you not care? What began as comfort ends up eroding the framing and, with it, part of the therapeutic work.

3 The dispersed clinical record

There are patients who tell important things by chat: a relapse, a decision, a weekend episode. If that is left alone in WhatsApp, your clinical record is incomplete.

The medical records is the document that the 26.529 law requires you to carry and keep. The relevant for the treatment has to be there, not distributed between a notebook, your memory and a chat that can be erased with a change of phone. If a patient communicates something clinically significant via WhatsApp, it is appropriate to record it in his medical records as any other data of the treatment.

What Professional Ethics Says

Professional secrecy does not distinguish channels. What a patient entrusts to you by chat is as protected as what he says in the divan: the Code of Ethics of FePRA obliges to protect the confidentiality of everything known within the framework of the professional relationship, without exception by the means used.

That has practical consequences:

• You can't forward or show patient chats, not even "anonymized" in peer groups.
• If a relative writes to you asking about the patient, you can't even confirm that he's being treated.
• You are responsible for the security conditions of the channel you choose to communicate with

If you want to deepen the scope and exceptions of the duty of confidentiality, we develop it in our guide on professional secret in psychology.

Good practices for using WhatsApp with patients

Ordered from the most structural to the most technical.

1. It will know the professional of the personal

Ideal is an exclusive line for practice: a separate chip or a second number with WhatsApp Business. Immediate benefits:

• Your personal number stops circulating between patients
• You can silence the professional phone outside your schedule without fault.
• WhatsApp Business allows you to configure visible schedules, absence messages and quick responses
• If you ever give up your schedule in a secretary or service, don't give up your personal life.

If you can't have two lines for now, at least use WhatsApp Business on the same phone for the professional profile and set the absence message with your schedules.

2. Express response schedules

Define and communicate when you respond to messages. For example: Monday to Friday from 9 to 18. There is no need to justify it: it is part of the frame, just like the session schedule.

Two details that help:

• Deactivate the blue tilde if the "view" generates more anxiety than information
• Use the WhatsApp Business automatic absence message to make the expectation clear without you having to hold it message to message

3 What you answer and what you take to the session

We already said it, but it deserves to be an explicit rule: administrative answer, clinical is taken to session. When clinical content arrives by chat, the answer takes care without intervening: you receive, value and re-frame. You do not interpret in writing, you do not open a therapeutic exchange at times.

4. Protocol to an off-time crisis message

This is the point that generates the most anguish and the one that can be improvised the least. If a patient writes in crisis to 2 AM and there is nothing agreed, whatever you do (respond, not respond, respond late) is left to chance.

The protocol is armed before, not during:

1. Leave it agreed on informed consent: WhatsApp is not an emergency channel, and in the event of a crisis the patient knows where to turn.
2. Accords the emergency routes according to the patient's area: the 911, the SAME (107 in CABA), the nearest mental health guard or the 135 line of suicidal assistance (CABA and GBA).
3. Define what you are talking about when you see the message: something short that recognizes gravity, remember the agreed resource and offer the nearest space. For example: "I received your message and I care what you're going through. If you're at risk now, call the [agreed resource]. Let's talk today at the [first available schedule]."
4. Record the episode in the medical records: what he wrote, what you answered, what was done next.

Having protocol doesn't make you less available as a therapist: it makes you predictable, which is exactly what a crisis person needs from their treatment.

5. Secure the phone and backup

The technical minimum, in four movements:

• WhatsApp 2-step verification: Settings → Account → Two-step verification. Prevent someone from activating your account on another phone by just having access to your line.
• End-to-end encryption rackup: Configuration → Chats → Backup → Copy encrypted end-to-end. Without this, your chats are readable in Google Drive or iCloud.
• Phone block with PIN or biometrics and automatic locking within a few minutes.
• Notifications without content on the locked screen: that a message came, not from whom or what it says.

6. Do not send reports or clinical material for WhatsApp

Psychological reports, certificates, evaluation results, and any clinical documents go through channels designed for that: hand-delivery, email with protected file, or a secure platform. A PDF with diagnosis circulating through WhatsApp can end up being forwarded, in an unencrypted backup, or on the wrong phone, and there you will no longer control anything.

How to include it in the frame from the first session

All of this works if you talk at the first session, not when the problem has already appeared. Communication between sessions is part of the frame, as well as fees, schedules and cancellations, and its natural place is informed consent.

A brief model that you can copy and adapt:

Intersessional communication. The WhatsApp [professional number] is used only to coordinate appointments, warnings and administrative issues. It is not a channel for dealing with treatment issues or for emergencies. Messages are answered from Monday to Friday from [time]. Faced with an emergency or risk situation, communicate with [agreed resources: 911 / SAME 107 / reference mental health guard / line 135]. What arises between sessions and is important for treatment is discussed at the next meeting.

Two sentences when presented reach: "I tell you how I handle messages between sessions, so we both know what to expect." Presented like this, it is not a barrier: it is care of treatment.

Automate the administrative to get it off your phone.

If you look at your professional WhatsApp, most messages are variations of the same: confirming the appointment, remembering the session, warning a change. All of this is automated, and automating it has a direct effect on the risks of this article: less administrative conversation on your personal phone is less exposed data and less out of schedule interruptions.

With Brauni, appointment reminders are automatically sent via WhatsApp from the platform, without exposing your personal number: the patient receives the reminder, confirms or warns that it does not arrive, and you see everything on the agenda without having touched the phone. In our guide on appointment management for psychologists we tell how this also reduces absenteeisms.

The practical result: your WhatsApp ceases to be an entry table and is what the frame says it is again, a channel limited to what really requires a message from you.

Frequently Asked Questions

Can I charge for answers for WhatsApp?

You can, as long as it is agreed in advance. Some professionals offer inter-session availability as part of their work mode, with scope and fees defined in the frame. What does not work is to charge it retroactively or implicitly: if they never spoke about it, the patient reasonably assumes that answering messages is free. Our suggestion: before monetizing the chat, ask yourself if that exchange should not be taking place in session.

What do I do if a patient sends me long audios counting his week?

Don't chat them: that confirms that the channel is useful for therapy. I answered briefly and will reschedule: "I listened to your audio, there are important things there. We take it on Thursday in session." If the pattern is repeated, it is clinical material: take it to session as a topic, not as a challenge. Behind the audios there is usually something worth thinking about together, from the difficulty to wait to the need to feel that the therapist is.

Should I use WhatsApp Business?

Yes, it is a concrete and free improvement: separate professional profile, visible schedules, automatic absence message and quick responses for the repetitive. It does not solve everything (the chats are still on your phone and the backup still needs encryption), but sort the channel and communicate professionalism. The ideal version remains an exclusive line for practice.

Are WhatsApp conversations part of the medical records?

The chat itself is not a valid clinical record, but the clinically relevant thing that a patient communicates there does have to be recorded in the medical records, which is the document that the 26.529 law requires you to carry out. The recommended practice: when something meaningful comes by message, you enter it in the medical records with date, as you would do with something said in session.

What do I do if a relative of the patient writes to me?

Professional secrecy also reaches you there: you can't confirm that the person is in treatment, nor comment on any of the work done, except for the usual legal exceptions (true and imminent risk, injunction). A possible answer: "For reasons of confidentiality I can't give you information. If there is a risk situation, I suggest you contact [emergency response]." And the episode, like everything relevant, is registered.

Summary

• WhatsApp with patients is valid as an administrative channel: appointments, notices, reminders and payments. Clinical matters go to session and medical records.
• The three main risks: confidentiality (unencrypted backups, screen, phone theft), availability 24/7 that erodes framing, and dispersed clinical record.
• Mental health data are sensitive data under the 25.326 Law, and the professional secrecy of the FePRA Code of Ethics applies equally in digital.
• Good practices: separate line or professional profile, explicit response schedules, written agreed crisis protocol, two-step verification, encrypted backup and no chat reports.
• The use of WhatsApp is agreed in the first session and is written in the informed consent, including the emergency channels.
• Automate reminders and confirmations (for example, with the WhatsApp reminders by Brauni) remove the administrative from your personal phone and return the channel, and rest.