WhatsApp for psychology practices: APA ethics, HIPAA and a bot that stays in its lane

A psychologist gets a WhatsApp message ("hi, I need help"). It's already a delicate ethical situation: the first message could be a genuine information request or a client in crisis. The APA Code of Ethics and HIPAA (in the US) regulate practice and confidentiality, and WhatsApp is permitted for administrative use with clear rules. This playbook shows how to use the channel without violating professional ethics, keeping confidentiality and PHI protection intact.

⚠️ Note: this content is informational. It does not replace consultation with your state licensing board, professional association or a healthcare attorney. Each state and association may interpret rules differently.

What's allowed and what isn't on WhatsApp

✅ Allowed (administrative use)

• Schedule an appointment.
• Confirm or reschedule a booked session.
• Send a 24h reminder.
• Send a payment receipt.
• Share office location.
• Answer administrative questions (price, payment methods, hours).

❌ Prohibited or questionable

• Therapy via WhatsApp outside of a HIPAA-compliant telehealth platform.
• Giving a clinical opinion or diagnosis ("you have anxiety", "this is depression").
• Discussing session content ("about what we talked about last week...").
• Forwarding client statements to third parties (even a spouse) without consent.
• Marketing that promises cures or makes comparative claims.

The bot that may exist (and the one that may not)

Administrative bot — OK

Triages, schedules, reminds, receives intake documents. Never touches clinical content.

Therapeutic bot — NO

"Are you feeling sad? Tell me about it..." → crosses into clinical territory and risks a board complaint. Even generative AI cannot replace a licensed clinician, especially in a crisis.

Ethical bot setup

1. Clear role disclosure

Client:  "Hi, I need help"

Bot:    "Hi! I'm the assistant for Dr. Marina Lee, Psy.D.
         (license #PSY12345). I handle scheduling and
         administrative questions — I do not provide
         clinical care.

         If you are in crisis right now, please call or
         text 988 (Suicide & Crisis Lifeline, 24/7, free).

         I can help with:
         • Booking an appointment
         • Rescheduling
         • Fees and insurance questions

         What do you need?"

Essential points:

• Identifies the clinician's license (per APA Standard 5.01).
• Makes clear this is an administrative assistant, not a therapist.
• Always mentions 988 in case of crisis — ethical responsibility.
• Lists exactly what it can do.

2. Crisis-detection trigger

Bot detects risk keywords and immediately fires the protocol:

Detected keywords (pseudocode): "suicide", "kill myself",
"can't go on", "want to die", "end it all", etc.

Bot:    "I hear you. First, are you in danger right now?
         If yes, please reach out NOW:

         📞 988 Suicide & Crisis Lifeline (24/7, free)
         📞 911 for immediate danger
         💬 Text HOME to 741741 (Crisis Text Line)

         I can also connect you with Dr. Marina right now,
         if you'd prefer. Want me to alert her?"

[Internal alert: bot pushes to the clinician's personal
phone — "URGENT: client showing signs of crisis"]

Critical: the bot never tries to "talk through" the content of the crisis. It only connects the client to the appropriate human resource.

3. Standard scheduling

Client:  "I'd like to book a session"

Bot:    "Of course! To book, I need:
         • Your full name
         • New client or returning?
         • Any preferred day/time?"

[Client replies, bot checks calendar, suggests 3 options]

Bot:    "Dr. Marina has openings:
         • Thursday 2pm
         • Friday 10am
         • Next Monday 4pm

         Which works best?"

4. 24h confirmation

Name: appt_reminder_psychology
Category: UTILITY

Hi {{1}}, reminder of your session tomorrow,
{{2}} at {{3}}, with Dr. Marina Lee (lic. {{4}}).

Address: {{5}}

Reply YES to confirm, or RESCHEDULE if you need to change.

Note: no mention of reason, concern or topic. Just date + clinician + address.

HIPAA with mental health PHI

Mental health is Protected Health Information (PHI) under HIPAA. Extra care:

BAA and platform requirements

• WhatsApp Business does not sign a Business Associate Agreement (BAA). Anything that includes PHI must go through a HIPAA-compliant platform.
• Administrative scheduling messages can pass through WhatsApp only if they contain no PHI (no diagnosis, no clinical details, no session content).
• Best practice: scheduling on WhatsApp, clinical content on a HIPAA-compliant EHR or telehealth platform (SimplePractice, Headway, etc.).

Operational conduct

• WhatsApp Cloud API — not the consumer app on a personal phone.
• Strict access — only the clinician and authorized scheduler.
• No screenshots — don't capture or forward to staff groups or personal backup.
• Minimum necessary: messages should contain only what's needed for the task.
• Retention: state laws vary (typically 7–10 years for clinical records). WhatsApp is NOT the medical record — don't treat it as one. Keep history short, file the summary in the official EHR.
• Right of access/deletion: clients can request access or amendment per HIPAA.

Telehealth: what changed

Post-pandemic, telehealth is broadly authorized but requires:

• State licensure where the client is located at the time of session (PSYPACT helps for participating states).
• A HIPAA-compliant telehealth platform (Doxy.me, SimplePractice, Zoom for Healthcare with BAA) — not regular WhatsApp.
• Technical criteria: secure connection, private environment, recording only with consent.

WhatsApp can be used to schedule the online session and send the platform link, but not to conduct it.

Ethical marketing

Per APA Standard 5 (Advertising and Other Public Statements). On WhatsApp:

• ❌ "Cure anxiety in 4 sessions."
• ❌ "Best psychologist in town."
• ❌ "Guaranteed results."
• ❌ Cold outreach to contacts who didn't request it.
• ✅ "Licensed clinical psychologist, lic. #X, serving adults with concern Y. Book your first session."
• ✅ Replying to anyone who wrote first.
• ✅ Administrative reminders to current clients.

Multi-clinician practice

A practice with 3+ clinicians: each client has a responsible provider. WhatsApp must:

• Route by clinician (Dr. A's client goes to Dr. A's queue).
• Confidentiality between clinicians (Dr. A doesn't see Dr. B's client history).
• Central reception may book for anyone, but clinical history stays compartmentalized.

Practical conclusion

WhatsApp + mental health works when you define a clear line: the bot is an administrative assistant, never a therapist. Crisis detection has a human-escalation protocol plus emergency phone numbers. Confidentiality and HIPAA are taken seriously.

Typical outcome: the clinician reclaims 6–10 hours per week previously spent on WhatsApp (without compromising ethics), clients get a professional response from the first message, and multi-clinician practices scale without mixing records.