Know where your practice stands before someone else checks.
A board complaint, an email slip, a client asking who can see their file. You do not want to find out where your practice stands in that moment. This is a plain-English review of how your practice keeps client information confidential, measured against what BC privacy law and your profession already expect. You get a scored report and a clear plan. We never touch your systems and you never hand us a password. About the cost of three or four sessions.
- A plain-language report on where your practice actually stands
- A 30/60/90-day plan, ranked by impact against effort
- A walkthrough call in plain language, no jargon and no fear
Not ready to book? Take the free two-minute check first.
The worst time to check is after someone asks.
Almost no solo or small practice has ever actually confirmed its client information is as private as it assumes. Not because anything is wrong, but because nothing has forced the question yet. Then something does. A client asks who can see their record. A form goes to the wrong address. Your college, an insurer, or a lawyer wants to know your practice met its duty. In that moment you are answering from memory, and hoping.
It is rarely the big obvious things. It is the shared login on the front-desk laptop. The intake form emailed as a plain attachment. The contractor who left last spring and still has access to your booking system. The backup nobody has ever tested. Any one of those is a confidentiality gap, and you would not know until the day it matters most.
Where you stand depends a little on your profession:
Psychologists. Your college sets a written standard for how client records must be stored, who may access them, and how access gets logged and removed. It is specific, and it is the standard you would be measured against if anyone ever asked. Most practices have never compared themselves to it line by line.
Clinical counsellors. You do not have a regulatory college with this power yet, so the duty here is PIPA and the trust your clients place in you. A confidentiality slip in a small counselling practice is a referral-and-reputation problem long before it is a legal one.
Social workers. Your code of ethics is explicit about how client records are handled, shared, and disposed of. The everyday habits of a busy practice are usually where reality drifts from the code.
Different words, same underlying question: if someone asked today, could you show that client information in your practice is actually kept confidential? This assessment is how you answer yes with evidence, before anyone asks.
A clear answer on where you stand, and a plan.
Not a forty-item checklist you have to decode. Three things.
A plain-language report.
We review the handful of areas that decide whether client information stays private: who can log in and how, how email and file sharing are handled, how records are backed up, how access is removed when someone leaves, and whether there is a plan for the day something goes wrong. Each area gets a plain pass, partial, or gap, so you can see at a glance where you actually stand.
A 30/60/90-day plan.
Your gaps, ranked by what matters most against what is easiest to fix. The two or three changes that move the needle in the first month are almost always cheap and fast. You will know exactly what to do first, what can wait, and roughly what each step involves.
A walkthrough call.
We get on a call and go through every finding with you in plain language. You can ask anything. You leave knowing what your risks are and what to do about them, whether or not you ever hire us for anything else.
Four steps. You never hand us your passwords.
A short intake call.
Fifteen minutes. You tell us how your practice runs day to day: what you use to book clients and keep notes, how you send forms and invoices, who works with you.
You show us, we look.
On a screen-share you walk us through your own setup while we note what we see, and we run the checks anyone can run from the outside, like whether your email is set up to stop scammers spoofing your address. That is the whole method. No login access, no passwords handed over, nothing on your systems touched or changed. We only review what you choose to show us plus what is publicly visible.
We score it and write your plan.
We turn what we saw into the scored report and the 30/60/90-day plan.
We walk you through it.
A call to go through every finding and answer your questions. You decide what happens next.
This is for you if
- You run a BC therapy practice as a psychologist, clinical counsellor, or social worker, solo or a small group.
- You keep client records in something like Jane or a similar system and handle intake, notes, and invoicing yourself or with a small team.
- You know you are responsible for keeping client information confidential and you want to know, concretely, whether you actually are.
- You would rather have a plain plan than a stack of jargon.
This is not for you if
- You are a hospital, health authority, or large clinic with your own IT and privacy staff. You already have people for this.
- You want someone to hack or break into your systems to prove they are weak. That is not what this is. We review and advise, we do not attack your setup.
Priced against a few sessions, not a big project.
The assessment is the starting point. Most practices fix the top few gaps, then decide whether they want us to keep an eye on things over time.
Practice Privacy Assessment
The full review, scored report, and 30/60/90-day plan, with the walkthrough call. Solo and small practices.
Founding rate $600
Group practice assessment
The same assessment for a multi-clinician practice, where more people, logins, and shared systems mean more to review.
$1,500
Practice Privacy Care Plan
Ongoing. We keep an eye on the basics on a regular schedule so your practice stays ready and defensible, month to month, and you have someone to ask whenever something changes.
From $200 a month
Help fixing the gaps
If you would rather not do the fixes alone, we can help you close them or do specific ones with you.
Scoped to what you choose to fix
For a solo practice the founding rate is about what you charge for three or four sessions. The plan it produces usually pays for itself the first time it stops you from making an expensive mistake. The founding rate is for the first five practices we work with, not a permanent discount.
Who is doing this.
Yellowbird is a small firm in Victoria, BC. We already run websites, hosting, and online setup for small practices and owner-run businesses, which means digging into how a small practice actually handles its information is our normal work, not a side venture.
We hold the Google Cybersecurity Professional Certificate. That is the technical half of the work. The other half is knowing what BC privacy law and your profession already expect of you, which is what turns a technical finding into something you can actually act on.
We are deliberately narrow about what we promise. This is an advisory review. We tell you where you stand and what to do about it, in writing, in plain language. We are not selling you software, we do not mark anything up, and we are not going to bury you in fear. The duty to keep client information confidential is real and already yours. Our job is to make it clear and manageable.
Before anything starts we sign a confidentiality agreement, because the review naturally surfaces private details about how your practice runs. What you show us stays between us.
The honest answers.
Is this a certification? Do I end up “certified”?
No. There is no privacy certification in Canada that a therapy practice needs, and we do not issue one. We measure your practice against the standards that already apply to you, your college's expectations and BC privacy law, and we build our checklist around the same federal baseline the government uses for small-business security. You get a clear report on where you stand, not a badge.
What qualifies you to do this?
We hold the Google Cybersecurity Professional Certificate, and the day job backs it up: Yellowbird already runs the websites, hosting, email, and file storage that small practices depend on, so how a small practice actually handles its information is familiar ground. On top of that sits a review method built around BC privacy law and your college's own record-keeping expectations. When a question genuinely needs a lawyer, we say so instead of guessing.
Do you access my systems or log into anything?
Never. You do not hand us passwords and you do not give us login access. We work from what you show us on a screen-share plus checks that are publicly visible from the outside. Nothing on your systems is touched or changed. That is a hard line, not a preference.
What about my EHR? I already use Jane (or Owl, or similar).
Good, that is the right foundation, and those systems handle their own side well: the encryption, the hosting, the secure storage. What they cannot control is how your practice uses them. Whether the right people have access and the wrong people had theirs removed, whether extra login security is switched on, whether forms and invoices leave the secure system as plain email. That gap between a good tool and how it is actually used is exactly what this assessment looks at.
Does BC law really require me to do this?
BC's privacy law (PIPA) requires you, as the practice, to protect the personal information you hold with reasonable safeguards. It does not hand you a checklist or send an inspector. So no one is forcing an assessment on you. What the law does is make the responsibility yours if something goes wrong. This is how you find out whether you are meeting it before that day, not after.
How long does it take?
About a week from the intake call to your walkthrough. The intake is fifteen minutes, the screen-share review is usually under an hour of your time, and we do the analysis and write-up on our side.
Is my information safe with you?
Yes. We sign a confidentiality agreement before we begin, we never take login access, and we only ever see what you deliberately show us. Nothing you share is stored beyond what we need to write your report.
Do I have to buy anything after the assessment?
No. The report and the plan are yours to act on however you like, including entirely on your own. Most people fix the quick wins themselves. If you would rather have us keep watch over time or help with the fixes, those are there, but there is no obligation and no pressure.
What will you actually tell me to change?
It varies, but the first-month fixes are almost always the cheap, high-impact ones: turning on a second login step for your key accounts, cleaning up who has access, tightening how forms and invoices get sent, and making sure your backup actually works. Boring, fast, and exactly the things that prevent the expensive problems.
I am a clinical counsellor with no college yet. Is this still relevant to me?
Very. Your duty runs through BC privacy law and through the trust your clients place in you, and neither of those waited for a regulator. A confidentiality problem hurts a small counselling practice through lost trust and lost referrals long before anyone official is involved. Knowing you are solid here is worth having now.
Do you do this outside British Columbia?
This offer is built specifically around BC practices and BC privacy law. If you are elsewhere, get in touch and we will tell you honestly whether we are the right fit.
Find out where your practice stands, before you have to.
Book the assessment and we start with a fifteen-minute call. Within about a week you have a scored report, a plain plan, and a call to walk through all of it. You will know exactly where your practice stands and what to do about it, on your terms and on a calm day, not in the middle of a bad one. No jargon, no scare tactics, no pressure to buy anything else.
Not ready to book? Take the free two-minute check.
Yellowbird. Victoria, BC.
Questions? brett@yellowbirdcompany.com