Secure Teletherapy Links: What Mental Health Clinics Need to Know

A teletherapy link is secure when only the intended client can use it, and only for the intended session. Everything else follows from that rule.

• A unique link generated for each session.
• A waiting room, so the clinician admits the client.
• Expiry once the session ends.
• Encrypted video and audio.
• Delivery through the client portal or a consented SMS or email.
• No recording unless the client has given specific consent.

Personal video accounts with one permanent meeting room fail most of these tests. Anyone holding an old link can join.

Reused links put clients at risk because they can be forwarded, guessed or opened by the wrong person. The clinic loses control of who joins.

A permanent room link may sit in old messages for months. If another client joins early, they may see or hear someone else's session.

That is a confidentiality breach. Under Kenya's Data Protection Act 2019, health data is sensitive personal data, and a breach with real risk of harm must be notified to the ODPC within 72 hours.

Clients may also join from shared phones or busy homes. Asking whether they can talk privately is part of a secure session.

Clinics should run every remote session through the same short routine, from consent to notes. Consistency is what makes it safe.

1. Record the client's consent to remote sessions, including how links will be sent.
2. Generate a unique link from the scheduling system for each appointment.
3. Send the link through the portal or the consented channel, close to the session time.
4. Admit the client from the waiting room after confirming their identity.
5. Confirm the client can speak privately, and follow your clinic's agreed start-of-session checks.
6. End the session for everyone and let the link expire.
7. Write notes in the clinical record, not in chat or email.

Your clinical leads should agree the checks used at the start of remote sessions. The workflow then makes them routine.

Teletherapy works across Kenya when clinics plan for variable connectivity. Many clients will join from phones on mobile data.

Choose a platform that runs in a mobile browser without a heavy app download. Offer audio-only as a fallback when video struggles.

Agree in advance what happens if the call drops. A short rule, such as calling back on a recorded number, saves time and worry.

Make payment easy too. Allow M-Pesa payment before or after the session, with clear fees in KES.

Some clients may prefer a private room offered by a nearby partner organisation. Where available, this helps clients without reliable data or privacy at home.

Teletherapy consent should cover how sessions run, how links are sent and how data is protected. It should be written in plain language.

Explain whether any part of the session is recorded, and why. Recording should only happen with specific consent.

Explain what happens if the connection fails. Also explain how the clinic handles concerns raised during remote sessions.

Store consent in the client record, with the date and version. Our data protection compliance checklist explains what else to keep on file.

Tymira360 links teletherapy to the appointment, so each session gets its own link and consent is checked first. Clients join from the portal on any phone.

Notes, attendance and payment sit in the same record as in-person sessions. See what features a mental health EHR should include.

Related reading: secure infrastructure for mental healthcare and continuity of care after a crisis.

Reminders can include the session time and how to join, without exposing clinical details.

Can we use WhatsApp video for therapy sessions?

It is generally best avoided for therapy, because it ties sessions to personal numbers and devices. A dedicated platform with unique links, waiting rooms and audit records is safer.

Should teletherapy sessions be recorded?

Only with the client's specific, informed consent and a clear purpose. Store any recording securely, with restricted access.

What if the client's connection drops?

Follow the reconnection rule agreed with the client at the start, such as switching to audio or calling back on a recorded number.

Is teletherapy covered by SHA or private insurers?

Cover varies by scheme and policy. Check current Social Health Authority and insurer rules, and tell clients clearly what they will pay in KES.

How should session links be sent?

Through the client portal, or by an SMS or email channel the client has consented to. Never post links in group chats.

Want to see secure, appointment-linked teletherapy in Tymira360? Book a demo with Tymira Health.