Can I See Therapy Clients Who Live Abroad?

Three things can go wrong and they are usually considered separately, if at all: the client's country may regulate who may treat them, EU GDPR can apply to you directly even though you are in the UK, and your indemnity policy may simply not cover the work.

Online therapy made this a routine question. The answers have not caught up, and the professional body guidance mostly says "check with your insurer" and stops.

Whose law applies?

The client's, as a starting point.

UKCP puts it about as plainly as it can be put: your client is receiving your services in the country where they are living, so it is imperative that you are aware of, and abide by, that country's laws.

That matters because psychological practice is regulated very differently around the world.

In the United States, licensure is state-level rather than federal. There is no single national permission. A client in California and a client in Texas present different questions, and some states take an active interest in unlicensed practitioners treating their residents.

Several European countries regulate psychotherapy and psychological practice with their own registration requirements, and a UK registration confers nothing there.

Some jurisdictions impose specific telehealth conditions. These can include requirements that would be impossible for a UK-based practitioner to satisfy.

The practical position: for a one-off session with an existing client who is travelling, the risk is usually low. For an ongoing caseload of clients resident abroad, it is a real question that deserves a real answer per country.

Yes, and this is the part almost nobody has worked through.

Article 3(2) of the EU GDPR applies to controllers outside the EU where they offer goods or services to people in the EU, or monitor their behaviour.

The critical qualification is the targeting test, set out in the European Data Protection Board's Guidelines 3/2018. The threshold is higher than most people assume.

Not enough on its own:

Your website being accessible from the EU
Publishing an email address or phone number
Using English

Likely to constitute targeting:

Advertising in the language of an EU country
Listing prices in euros
Naming EU countries you serve
Paying for advertising directed at an EU audience
A directory listing aimed at clients in an EU country

So a UK therapist with an ordinary UK-facing website who happens to see one client who moved to Spain is probably not targeting. A therapist whose site says "serving British expats in Spain and France" almost certainly is.

What happens if you are caught by it?

Article 27 requires a controller caught by Article 3(2) to designate a representative in the EU, in writing, in one of the member states where the relevant people are.

There is an exemption in Article 27(2), and it is very hard for a therapist to satisfy. It requires the processing to be occasional and not to include large-scale processing of special category data.

Ongoing weekly therapy is not occasional. Therapy notes are Article 9 special category data. The exemption is written for genuinely incidental processing, which is not what a therapeutic relationship is.

Breach of Article 27 alone carries fines of up to €10 million or 2% of global annual turnover. For a sole practitioner those numbers are theoretical, but the obligation is not.

What about your insurance?

The question professional bodies point you at, and the one with the clearest answer available.

UK indemnity policies commonly carry territorial limits and sometimes day-count caps on overseas work. As a comparison from an adjacent profession, CSP professional liability covers members based in the UK treating patients in the UK, and patients based overseas except in Australia, the USA and Canada, and does not extend to any country where telemedicine is subject to local regulation.

That last clause is the interesting one. It means the policy exclusion tracks the regulatory question: if the client's country regulates telehealth, the cover may fall away precisely where you most need it.

Check your own policy wording rather than assuming. Ask specifically about the countries your clients are actually in, and get the answer in writing.

A workable approach

Six steps that resolve most of this.

Ask where the client is physically located, at intake and again if it changes. "Where are you living?" is a reasonable clinical question, not an intrusive one
Check your indemnity for that country before the first session, not after the third
Decide whether you target the EU, and if you do, take advice on Article 27
Do not advertise into other jurisdictions unless you have deliberately decided to and have covered the consequences
Have a policy for clients who move. It happens mid-therapy, and an ending you planned for is better than one forced by an insurer
Say it in your contract, so a client who relocates knows the arrangement may need to change

What about clients who are just travelling?

The common and easier case.

A client on a two-week holiday is still resident in the UK and is receiving your service in the ordinary course of a UK therapeutic relationship. Most of the concerns above bite on residence rather than momentary location.

But check your policy wording, because some are drafted around where the client physically is at the time of the session rather than where they live. That is exactly the sort of detail that only matters once.

The honest summary

For a UK therapist with UK clients who occasionally travel, this is a small question. For a practice built on clients living abroad, it is three separate questions wearing one coat, and only one of them is answered by asking your insurer.

Our guide to when police or courts ask for your therapy notes covers a related area where UK content is drowned out by American material that does not apply here.

This is general information, not legal advice. Whether EU GDPR applies to you, and what another country's law requires, depend on specific facts. Take advice before building a caseload of clients resident outside the UK, and confirm your indemnity position in writing.

Sources: EDPB Guidelines 3/2018 on territorial scope · GDPR Article 27, representatives · UKCP, working overseas