Counseling Practice Analytics and HIPAA: Why Counts May Cross and Names May Not

I have known what a funnel is for a long time. That was never the problem. The problem was that I could not answer three questions about my own counseling organization.

Where is my traffic coming from. What are my conversion rates at each stage. What can I do to improve them.

Those are ordinary questions. Most businesses buy an answer to them on a Tuesday afternoon. I could not. Every clinician who has ever wanted to know whether their practice is growing runs into the same wall, and it is not where you would expect it.

Four tools, four fragments

Some of the answer was in Google Search Console. Some was in Google Analytics. Some was in Bing Webmaster Tools. Some was in BrightLocal. Each tool held a piece and none of them held the shape.

I had tried the products that promise to put the pieces together. Raven Tools, once. HootSuite, once. They give you a canvas and a box of widgets and invite you to build your own report, and what you get is a poster. I wanted something narrower and more boring than a poster. One table, on one screen, with no scrolling and no searching and no filters to set first. Every figure carrying its own comparison: this week against last, this month against last, this quarter, this year. If I want to know what is under a number, I click the number.

None of that is the hard part.

The bottom of the funnel is inside the health record

A search result is not a client. Between the two sit a booking, a consultation, an intake, a delivered session and a collected payment. The last several of those live inside TherapyNotes, the electronic health record my organization runs on.

That is where measuring a counseling practice stops being like measuring a business.

An electronic health record is not a database of appointments. It is a record of patient encounters, and in American health privacy law almost everything in it is protected health information: the identifiers that attach a fact to a person. A name. A date of birth. An address. A phone number. A full date tied to an individual. Even the initials in a calendar entry, which is a detail I will come back to.

So the question I actually had to answer was not how to build a chart. It was how to get the numbers I need out of the health record without moving anything I am not allowed to move.

I am not an attorney and this is not legal advice. This is how I think about it as the person responsible for the organization.

What may cross, and what may not

The line I settled on is short enough to hold in your head.

Counts may cross. Identifiers may not.

The fact that eleven consultations were booked last week is not protected health information. Nobody is identified by it. The fact that a particular person booked a consultation on a particular Tuesday is protected health information, and it stays where it is.

That sounds obvious written down. It is not obvious in practice, because the useful numbers and the forbidden ones live in the same rows. You cannot count intakes without touching records about people. The counting has to happen somewhere, and where it happens is the whole design.

The line is enforced before anything is written down

Here is the part I would want another practice owner to copy.

Ordinary software, running on my own machine, removes the protected information before it writes any number to my dashboard. Not an AI. Plain code, doing a plain job, in a fixed order, every time.

Appointment types are filtered where they are requested, so only the two types I am measuring ever come back. Calendar entries are counted and discarded, never stored, because the titles of those entries carry client initials.

By the time anything reaches a file on disk, there is nothing left that points at a person. Not scrubbed afterward. Never written in the first place.

The order matters more than the technique. Decide what may cross. Enforce it before the first write. Then find out what you can still measure with what is left. When I did it in that order the answer was very nearly everything I wanted, which surprised me. I had assumed the privacy constraint would cost me most of the picture. It cost me almost none of it.

The part that is still done by hand

The tidy version of this story would end there. It does not.

TherapyNotes offers no way for another program to ask it questions. There is no connection to open. And its terms forbid automated browsing, which is software driving the screen the way a person would, even when that software is covered by a signed privacy agreement. So that door is closed twice: once because there is no handle, and once because I agreed not to force it.

Which means that once a week, I log in and export the reports myself.

Everything above the health record is automatic. The bottom of the funnel is me, on a Monday, doing it by hand. I have not found a way around it that I am willing to take. The automatic version of this story would read better and it would not be true.

What it tells me, and what it does not

The bottom of my funnel is not a count of notes. It is how full each clinician’s caseload is against what that clinician can carry.

That number is not a score I watch. It is a switch. Below eighty percent booked, my work outside of sessions goes to demand: the website, search, the referral network. Above eighty percent, it turns to research and writing, which feeds search from the other direction. A dashboard that only reports is decoration. This one decides where my hours go on the days I am not in session.

Three honest limits.

The daily figure is noise. I do not read it daily and it would tell me nothing if I did. A week is the smallest unit that carries a signal, which is why every figure on the page carries a comparison rather than a live count.

It has not surprised me yet. In the months it has been running it has confirmed things I suspected and has not once argued with me. I expect that to change. It has not changed so far, and a page that claimed revelations would be a page I made up.

And it does not know why. It can tell me that consultations held fell against the month before. It cannot tell me whether that was the weather, a referral partner going quiet, or a page that dropped out of the search results. That is still my job.

Who else reads it

I am not the only audience. My organization is a nonprofit with a board, and the same table I use to decide my own week is what I report with. That turned out to matter more than I expected when I built it. A number you have to explain to people who were not in the room has to be defensible in a way that a private number does not.

What is real here, and what is not

• 8 stages, from search result to collected payment
• 4 comparisons on every figure: week, month, quarter and year against the one before
• 2 places where identifying information is removed before anything is written down
• 1 weekly export I do by hand, because the health record has no other door
• 0 times it has told me something I did not already suspect
• 80 percent booked, the point where I stop chasing demand and start building authority

One practice. One person. No product, nothing for sale, and no claim that any of it would survive contact with a larger organization. What I think does carry across is the order: settle what may cross before you build anything, and find out afterward how much you can still see.