Do your counsellors ensure that private and confidential client data is private from the moment of capture onwards - ie on the device, on the network, and in storage?
Does your institution take data privacy seriously enough to spend money and change behaviour?

(Note - secure is NOT private. Any use of cloud storage where the data is not deliberately encrypted before storing is likely to be compromised)

Please boost for reach.