WebPT Ideas and Discovery

First, it is a HIPAA concern, if not a violation, for all providers to see the names of all clients in the practice in a common area. Therapists are only privy to their own clients' charts (hence PHI), so why would it be different when it comes to the client portal messaging area? Names of clients attending psychotherapy are PHI. Some clients are prominent in their communities and are discreet about coming to psychotherapy, so their names should not be listed for all providers in a practice to see. There is also the possible user mistake of messaging a client that the therapist is not even treating, given clients with similar names all being listed in that common area. Could you modify it so that either a) only clients who are being treated by that therapist are visible in the therapists messaging area, or b) the whole client list can be hidden with a permission setting, so only admin level staff would have access to the whole list? Either of these would make the client portal messaging feature more HIPAA secure and more useful. Thanks.