A Week of Privacy, Consent, and Role-Boundary Failures in an Online Practice
You run a solo online coaching practice. Six months in, you discover the following in one week: (a) your client portal is a shared Google Drive folder where each client's intake form, food logs, and a recent lab PDF are visible to anyone with the link, which you have posted in a public Facebook group to attract clients; (b) you posted a before/after photo of a client with her face visible and her name in the caption - she signed a general services agreement but nothing about marketing; (c) a client's registered dietitian emails you asking to coordinate, and you are not sure whether to respond because you 'don't want to step on toes'; (d) a client asks you to write a letter supporting her insurance claim for medical nutrition therapy.
1. Rank these four issues by urgency and risk, and state the first action for each.
Read the worked answer
Ranked by urgency and exposure:
- (a) Data exposure. A publicly reachable link containing intake forms, food logs, and lab PDFs is the highest-risk item - health information plus direct identifiers, discoverable by anyone. First action: revoke sharing or delete the link, verify access is actually closed, then determine which clients were affected and what was visible. Notification duties depend on jurisdiction and on whether a state breach statute or the FTC Health Breach Notification Rule applies. A coach is generally not a HIPAA covered entity - that is not the same as having no obligations. Get advice before you notify anyone.
- (b) Marketing use of a client photo. A general services agreement almost certainly does not authorize use of her image and name in marketing. First action: take the post down today, then request a specific written release.
- (d) The insurance letter. Writing a letter supporting a medical nutrition therapy claim implies you provided MNT, which you did not. Decline, explain the reason plainly, and refer.
- (c) The RD's email. Lowest immediate risk, easiest to get wrong. Respond professionally, clarify your role, ask what she wants coordinated. Silence reads as territorial and serves the client badly.
2. What documents would you put in place to prevent recurrence, and what should each contain?
Read the worked answer
Four documents, each doing a distinct job:
- Privacy policy and data-handling statement. What you collect, where it is stored, who can see it, retention period, and how a client requests deletion. Plain language, given at onboarding, not buried in a PDF.
- Informed consent. Scope of practice in concrete terms - what you do and do not do - plus limits of confidentiality, how referrals are handled, and an explicit acknowledgment that you are not a substitute for medical care and that acting on nutrition advice without medical clearance carries risk.
- Separate marketing release. Opt-in, revocable, specifying exactly what may be used (photo, name, quote, de-identified data), where, and for how long. A checkbox buried in the services agreement is not sufficient.
- Vendor and access register. Which platforms hold client data, who holds credentials, 2FA status, and a quarterly access review. The Drive problem was a process failure, not a one-off.
Add a written breach-response checklist and a retention/destruction schedule, and review all of it annually. The test of these documents is whether a new client could understand them without you in the room.