Therapy clinic software privacy questions: a worksheet for each vendor

Download a printable therapy software privacy questions worksheet (PDF or Word)

One worksheet per vendor with questions, answers, written sources, verifier and follow-up. The blank PDF prints on US Letter paper (2 pages) and the Word document can be edited to match your clinic’s fields. Both are free to download with no sign-up.

How to use the therapy clinic software privacy questions worksheet

Print one copy for each vendor on your shortlist and fill in the vendor name and date at the top. Put each question to the vendor in writing, then record the answer in the vendor’s own words rather than your summary of it.

The worksheet has five columns: the question, the vendor’s answer, where it is written down, who verified it and the follow-up. An answer that exists only in a sales call is not yet an answer. Ask for a link to a public page, a clause in the agreement or an email you can file.

Your clinic’s obligations depend on your province, your regulator and how the clinic is set up. For the longer checklist of what to check in a demo, read the PHIPA-focused companion guide below. This page is the blank form to fill in.

Access roles and the audit trail

These questions test who can open a record and whether the system can show who did what. Ask the vendor to demonstrate each one with fictional records, not to describe it.

• Which staff roles exist, and can each be limited by branch, by client and by task?
• Can the practice change a role’s permissions, and who at the vendor can see our records?
• Does the system keep an audit trail of views, edits and exports, and who in our clinic can read it?
• How long is the audit trail kept, and can we export it?
• Is multi-factor sign-in available for staff, and how long does a session last?

Where data is processed, and the named exceptions

Ask for the production location of the application, database, uploaded files and backups, and then ask separately which providers process data elsewhere. A single sentence about location rarely covers the exceptions, so match each exception to a feature you plan to use.

As an example of the level of detail to expect, here is how TherapyCRM words its own answer. The production application, database, uploaded files and backups run on Google Cloud in Toronto, and the session cache is in Canada.

Named exceptions: providers for email and text messages, payments, optional AI features, app notifications, bot checks, optional website analytics and video, and calendars a practice connects process limited data outside Canada, and rollback and testing copies are held in the United States and Germany.

• Where are production data, uploaded files and backups stored?
• Which providers (subprocessors) receive data, what does each receive and where does each process it?
• Do test or pre-release environments hold copies of real records?
• What leaves the system if we turn on optional features such as text messages, AI or a connected calendar?

Breach notification, export, deletion and backups

These questions cover what happens when something goes wrong and when you leave. Reporting duties differ by province, so the worksheet records the vendor’s commitment and leaves the legal duty to your own advisers.

• How and how quickly will you tell us about an incident that touches our records, and who is the contact?
• Which backups exist, how often are they made, how long are they kept and can we ask for one to be restored?
• How do we export all records, including notes, documents and the audit trail, and in what format?
• What happens to our data when we cancel, how long until it is deleted and how do we get confirmation?
• Can a single client’s record be corrected or deleted on request, and who performs it?

Family portal sharing and staff offboarding

Two everyday routines expose records more often than a technical failure does: what families can see, and what departed staff can still reach.

• What does a guardian see in the family portal, who decides what is shared and can sharing be turned off for one family?
• Where is a family’s consent to portal sharing recorded, and can we show it later?
• Can a second guardian, or a person acting for a client, be given separate access and removed again?
• How do we remove a departing staff member’s access the same day, and what can that person still see afterwards?
• Can we list who has access today so we can review it when roles change?

A fictional completed example: three rows

The rows below use an invented vendor and invented staff. They show the level of detail worth recording, including an answer that is not yet verified. They are not a statement about any real product.

Swipe or scroll sideways to view all table columns.

Decisions the worksheet cannot make for you

The worksheet records evidence. It does not decide whether a vendor is acceptable for your clinic.

• Who is the custodian or responsible party for your records, and what contract terms follow from that? Ask your counsel or privacy officer.
• Which statute and regulator apply in your province, and what each requires of a clinic that uses a vendor.
• How much risk the clinic accepts when a vendor holds no certification or answers only part of the list.
• Whether to compare vendors side by side in a scored demo before choosing.

Frequently asked questions