Patient Data Protection for Physiotherapists

Data protection is treated as paperwork right up until something happens — a stolen laptop, a message sent to the wrong person, a patient who asks for their complete record and a sharply worded email from their solicitor a week later. Very little of what follows is technical, and almost all of it is cheaper to do before it is needed.

What counts as patient data

More than the clinical note. In practice a physiotherapy practice holds identifiable health information in at least these places, and they all count:

• The clinical record, assessments and progress notes.
• The diary, which reveals who is being treated and when.
• Invoices and payment records, which link a person to treatment.
• Photographs, videos and body charts.
• Referral letters, imaging reports and correspondence with other clinicians.
• Messages. The WhatsApp thread where a patient describes their symptoms is part of the record in substance, whatever it is in your head.
• The spreadsheet on the desktop called patients_old.xlsx, which everybody has and nobody remembers.

Health data is a special category almost everywhere: GDPR requires an additional condition for processing it, HIPAA governs it in the United States, and Australia, Canada, the UK and most of Latin America have equivalents. The names differ; the obligations rhyme.

Why you are allowed to hold it

A common misunderstanding is that consent is what permits you to keep clinical records. Usually it is not. In most frameworks, records of care are held because you are providing healthcare and are legally required to document it — which is why a patient can withdraw from treatment without being able to demand that the record of past treatment be deleted.

Consent does the work elsewhere, and it is worth separating clearly:

• Treating and documenting: provision of healthcare, plus your professional record-keeping duty.
• Contacting them about appointments: part of providing care, in the way they agreed to be contacted.
• Marketing, newsletters, reactivation campaigns: consent, freely given and withdrawable.
• Photographs, video, teaching, case studies, social media: separate, specific, written consent.

The practical minimum for a small practice

A solo physiotherapist does not need a compliance department. These are the things that would actually matter if anyone looked:

1. A screen lock and a real password on every device that touches patient data, plus full-disk encryption — which is a single setting on any modern laptop or phone.
2. Two-factor authentication on your email and on your clinical system. Email is the master key to everything else.
3. One account per person. Shared logins destroy the audit trail, and the audit trail is what proves who saw what.
4. A backup you have actually restored from. An untested backup is a belief, not a safeguard.
5. No patient data on personal devices beyond what the clinical system shows through a browser.
6. A written retention rule, one paragraph, applied.
7. A privacy notice the patient can read at intake: what you hold, why, for how long, who else sees it, and how to complain.
8. A list of everyone who processes data for you — software, accountant, booking tools — with a contract or terms in place. In GDPR terms these are processors and the relationship is meant to be written down.

How long to keep records, and how to destroy them

Retention periods are jurisdictional and the ranges are long. Adults are commonly seven to ten years from the last episode of care; children are usually kept until a number of years after they reach the age of majority; some jurisdictions apply longer periods to particular categories. Look up the rule that applies where you practise rather than copying a figure from an article — including this one.

Two failure modes, both real:

• Deleting too early, which leaves you unable to answer a complaint about treatment you cannot document.
• Keeping everything forever, which is a breach of the data minimisation principle and means a leak in ten years exposes patients you last saw two decades ago.

Destruction is part of the duty. Paper is shredded, not binned. Digital records are deleted from backups as well as from the system, which is a question to ask your vendor explicitly. And an old laptop or phone is wiped before it is sold, given away or recycled.

When a patient asks for their record

This happens more often than people expect, usually around an insurance claim, a second opinion or a dispute. The process is not difficult if you have decided it in advance:

• Verify who is asking, proportionately. A solicitor or insurer needs written authority from the patient.
• Respond within the legal period, typically around a month.
• Usually free of charge for a first copy.
• Redact third parties. If a family member’s information appears in the notes, it does not travel with the copy.
• Never amend a record after a request. If something genuinely needs correcting, add a dated correction that leaves the original visible. Altering a note retrospectively turns a clinical disagreement into a credibility problem.

WhatsApp, email and the group chat problem

Messaging apps are how patients want to be contacted, and pretending otherwise does not stop them. The workable position is a line about content rather than a ban on the channel:

• Logistics by message: times, reminders, addresses, “the report is ready”.
• Clinical content in the record: assessments, reports, imaging, photographs.
• Never a group chat containing more than one patient. Class and group-treatment chats leak identities by design.
• Check the recipient before sending. The most common breach in small practices is not a hacker; it is the right message to the wrong person.
• Disable media auto-save to the camera roll if patients send you photographs, so clinical images do not end up in a personal cloud backup.
• Email attachments with a password for anything substantial, with the password sent by a different channel.

What to ask a software vendor

Compliance badges on a pricing page mean less than clear answers to plain questions. Ask these before you commit, and keep the replies:

• Where is the data physically stored, and in which country?
• Is it encrypted in transit and at rest, and who holds the keys?
• Who at your company can read my patients’ records, under what circumstances, and is that logged?
• How are backups taken, how long are they kept, and when were they last restored?
• Can I export everything — records, notes, files, finances — in a usable format, on my own, without asking you?
• What happens to my data if I stop paying, and how long before it is deleted?
• Do you have a data processing agreement I can sign, and will you notify me of a breach within a defined time?
• If my regulator requires a specific contract — a business associate agreement, data residency in a particular region — can you provide it?

That last question deserves a straight answer rather than reassurance, and it is the one worth asking first if you practise somewhere with a specific statutory contract requirement.

When something goes wrong

A phone is stolen, an email goes to the wrong address, a laptop disappears from a car. What determines the outcome is almost entirely what happens in the following hours:

1. Contain it. Remote wipe the device, change passwords, revoke sessions, recall the message if the platform allows.
2. Write down what happened, with times, while you remember. This record matters later.
3. Assess the risk to the people involved, not the embarrassment to you.
4. Notify the regulator if your jurisdiction requires it — in the EU and UK that is 72 hours for breaches likely to pose a risk.
5. Tell the patients affected if the risk to them is high. Directly, plainly, and before they hear it elsewhere.
6. Change the thing that allowed it. A breach with no change afterwards is the same breach waiting.

What Physioly does, and what it does not claim

What the system provides: records held in one account rather than scattered across devices, one login per person with roles that limit what each one sees, an encrypted connection, automatic daily backups, an audit trail of activity in the account, and export of your data so leaving does not mean losing it. A public patient card exists for sharing specific information with a patient, rather than sending clinical documents through a messaging app.

What we do not claim: Physioly is not sold as certified under any particular framework, and you will not find a HIPAA or GDPR badge on our pricing page, because a badge is not a control. If your regulator requires a signed business associate agreement, data residency in a specific region, or a formal certification from your supplier, ask us directly before you commit — that is a question with a concrete answer, and getting it after you have migrated three years of records is the wrong order.

Everything else in this article is yours regardless of which product you choose. No software makes a practice compliant; it can only make the correct habits easier to keep.

Questions we get asked

Is patient health data treated differently from other personal data?

Yes. Under GDPR it is a special category requiring an additional condition beyond your lawful basis; in the United States it is protected health information under HIPAA; Australia, Canada, the United Kingdom and most Latin American countries have equivalent rules. The common thread is that health data attracts stricter handling, longer retention duties and heavier consequences when it is lost.

Can I send patient information over WhatsApp?

Appointment logistics — times, reminders, directions — are generally fine if the patient agreed to be contacted that way. Clinical detail, photographs, reports and test results are a different matter: that content sits on a device that may be shared, backed up to a personal cloud and readable by anyone who picks up the phone. Keep clinical content in the record and send a message that says a document is waiting, rather than attaching it.

How long should a physiotherapist keep patient records?

It depends entirely on your jurisdiction, and the ranges are long: commonly seven to ten years from the last episode for adults, and for children usually until some years after they reach adulthood. Check the rule that applies where you practise, write it down, and apply it consistently — deleting too early is a regulatory problem and keeping everything forever is a different one.

Does a patient have the right to see their physiotherapy notes?

In almost every jurisdiction, yes, and usually within a defined period and at no cost for a first copy. Records are written to be read by other professionals, but they can be read by the patient too, so write them in a way you would be comfortable explaining. Do not amend a note after a request arrives — corrections are made as dated additions, never by overwriting.

Is cloud physiotherapy software safe for patient records?

It can be considerably safer than a laptop under a desk, provided you ask the right questions: where the data is stored, who can access it, whether it is encrypted, how backups are taken and tested, and what happens to your data when you leave. A vendor who answers those clearly is a better sign than one advertising a compliance badge.