CAP standards of practice: Alberta therapist email
Updated
- CAP sets practice standards that apply to email with clients
- CAP’s standards are general but create binding obligations for members
- Private practice psychologists fall under Alberta PIPA plus CAP standards; HIA’s s.60 safeguards and s.64 PIA bind custodians and reach a therapist mainly as an affiliate inside a custodian organization
- CAP is set to regulate counselling therapists, with its own code and standards still in development
The College of Alberta Psychologists (CAP) regulates professional conduct for psychologists in Alberta. If you’re a registered psychologist, CAP’s practice standards govern how you communicate with clients, including over email. But CAP’s standards don’t exist in isolation. A privacy law sits underneath them: Alberta PIPA for solo private practice, with Alberta’s Health Information Act (HIA) reaching you when you work as an affiliate inside a custodian organization.
This guide covers both: what CAP expects for digital communication, and how the privacy law layer works, including where HIA fits.
If you’re already familiar with HIA email requirements for therapists, this post focuses on the professional college side of the equation.
Which CAP standards of practice apply to email?
CAP’s standards of practice apply to email the same way they apply to any client communication. For digital communication, the standards that matter most cover informed consent, confidentiality and release of information, recording consent, and the Use of Technology guideline. Record retention runs a minimum of 10 years.
| CAP standard or guideline | What it sets for email | Reference |
|---|---|---|
| Informed consent | The elements of consent, and the client’s understanding, before you send health information by email | Standards of Practice 3.5.1 to 3.5.12; understanding at 3.4 |
| Confidentiality and release of information | Protecting client information and the rules for releasing it, including by email | Standards of Practice 12.3 and 12.6 |
| Recording consent | Documenting the client’s consent to electronic communication in the file | Standards of Practice 12.18 |
| Use of technology | A technology risk analysis, the limits of confidentiality, an emergency plan, and a restriction on putting client data into AI tools or relying on AI generated reports for clinical decisions | Use of Technology guideline (Sept 1, 2024) |
| Record retention | Keep client records a minimum of 10 years from the last service or the client’s age of majority, whichever is later | Standards of Practice |
Which Alberta law sits underneath: in solo private practice, Alberta PIPA applies, and its section 34 reasonable security arrangements duty is the source of the safeguards obligation, including encryption, not a CAP rule. HIA’s section 60 safeguards and section 64 PIA reach you only as an affiliate inside a custodian organization. Solo private practice psychologists are not HIA custodians.
Who does CAP regulate?
CAP regulates psychologists and provisional psychologists in Alberta. Registration with CAP means you’re bound by its Standards of Practice, practice guidelines, and Code of Ethics. CAP is expanding its mandate to include counselling therapists under changes to the Health Professions Act.
Right now, CAP’s jurisdiction covers psychologists and provisional psychologists. If you hold registration with CAP, you’re subject to its Standards of Practice, its practice guidelines (including the Use of Technology guideline), and the Canadian Code of Ethics for Psychologists.
That scope is set to expand. CAP is to develop a code of conduct, practice standards, and education requirements for counselling therapists, pending provincial funding. It is not yet established that the current psychologist standards will apply to counselling therapists unchanged. The timeline and details of that expansion will be covered in a separate post.
What does registration mean for your email? It means CAP’s practice standards apply to every channel you use to communicate with clients. Email included. On the privacy side, solo private practice falls under Alberta PIPA; HIA’s custodian obligations reach you mainly as an affiliate working inside a custodian organization, such as a clinic with physicians or AHS.
CAP practice standards for digital communication
CAP’s approach to digital communication sits across two documents: the Standards of Practice and the Use of Technology practice guideline (approved September 1, 2024).
Standards of Practice
CAP’s Standards of Practice set baseline expectations for professional conduct. They cover informed consent, confidentiality, record keeping, and competence. None of these standards are email specific, but all of them apply when you use email to communicate with clients.
CAP’s Standards of Practice require psychologists to protect confidentiality of client information (Standard 12), obtain informed consent for services (Standard 3), and maintain and retain records of professional activities (Standard 7). These obligations extend to every communication channel, including email.
For example, Standard 12 (confidentiality) applies to email just as it does to paper files. If you send an email containing a client’s health information without adequate safeguards, you’re potentially in violation of both CAP’s standards and the privacy law that binds your practice: Alberta PIPA in solo private practice, or HIA where you work as an affiliate inside a custodian organization.
Use of Technology guideline
The Use of Technology guideline is where CAP gets more specific. Updated in September 2024, it covers telepsychology, technology and informed consent, and social media.
On electronic communication with clients, the guideline expects psychologists to:
- Obtain informed consent that addresses the risks and limitations of electronic communication
- Use technology that provides adequate confidentiality protections
- Maintain records of electronic interactions as part of the clinical record
- Consider whether electronic communication is appropriate for the specific clinical situation
Here’s what’s worth noting about CAP’s approach: it’s principles based, not prescriptive. CAP doesn’t tell you which email service to use or specify an encryption standard. It says you need “adequate confidentiality protections” and leaves the technical details to you.
How this compares to CRPO Standard 3.4
If you’ve read about CRPO electronic practice standards, you’ll notice a difference in specificity. CRPO’s Standard 3.4 sets out seven clauses, backed by a six page guideline, covering secure electronic communication, informed consent specific to electronic practice, and documentation obligations. It names categories of technology, specifies what consent should address, and requires professional liability insurance that provides sufficient coverage for electronic services (3.4.4).
CAP’s guidelines are shorter and more general. They set the direction without mapping every step. That gives Alberta psychologists more flexibility, but it also means you’re responsible for filling in the technical details yourself, or looking to HIA for the specifics.
Where HIA fits for Alberta psychologists
CAP sets professional practice standards. The privacy law sets legal requirements. For private practice psychologists, that privacy law is Alberta PIPA plus CAP standards; HIA reaches you mainly as an affiliate working inside a custodian organization such as a clinic with physicians or AHS. Where CAP says “use adequate confidentiality protections,” Alberta PIPA requires reasonable security arrangements, and HIA section 60 sets a parallel safeguard duty for custodians.
CAP tells you to protect client confidentiality in digital communication. The privacy law tells you the legal floor: Alberta PIPA for solo private practice, HIA where you work as an affiliate inside a custodian organization.
Two HIA sections matter most when HIA reaches you, so they are worth knowing even if you sit under PIPA today.
HIA s.60: security safeguards
Section 60 of the Health Information Act requires custodians to take reasonable steps to maintain administrative, technical, and physical safeguards that protect the confidentiality of health information. It also requires safeguards against threats to security, loss of health information, and unauthorized access, use, disclosure, or modification. This duty binds custodians, so it reaches a private practice psychologist as an affiliate inside a custodian organization. In solo private practice, the parallel duty comes from Alberta PIPA, which requires reasonable security arrangements against unauthorized access, collection, use, disclosure, copying, modification, or disposal.
For email, this means:
- Health information sent by email should be encrypted (OIPC Alberta has recommended encryption for diagnostic, treatment, and care information sent electronically)
- Your email system needs protections against unauthorized access (strong passwords, two factor authentication at minimum)
- You need a plan for what happens when something goes wrong (breach response)
Neither HIA s.60 nor Alberta PIPA names a specific encryption standard. But “reasonable” safeguards are measured against what’s available and practical, and in 2026, email encryption is both.
HIA s.64: mandatory Privacy Impact Assessment
HIA section 64 requires custodians to submit a Privacy Impact Assessment (PIA) to the Office of the Information and Privacy Commissioner of Alberta (OIPC Alberta) before implementing any information system that collects, uses, or discloses individually identifying health information. This includes email systems. The PIA must be submitted before implementation, not retroactively. The duty falls on the custodian, so it reaches a private practice psychologist as an affiliate inside a custodian organization; solo private practice falls under Alberta PIPA, which has no PIA requirement.
Section 64 is where Alberta’s custodian rules go further than most provinces. If a custodian organization is implementing a new email system (or making changes to an existing one that handles health information), the PIA goes to OIPC Alberta before the system goes live. If you practise inside such an organization as an affiliate, your email setup is part of that submission.
Not after. Before.
The PIA documents what health information the system collects, how it’s used, who has access, and what safeguards are in place. OIPC Alberta reviews it and provides comments. For custodians, this is a legal requirement under HIA, not a best practice suggestion. Solo private practitioners are not designated custodians, so HIA s.64 does not bind them, and Alberta PIPA imposes no PIA.
For a deeper walkthrough of the PIA process, see the privacy impact assessment template (coming soon).
Where the two layers overlap
| Requirement | CAP source | Privacy law source | Which controls? |
|---|---|---|---|
| Informed consent for electronic communication | Use of Technology guideline | Alberta PIPA consent rules (HIA s.34 in custodian settings) | Both apply; the privacy law sets the legal floor |
| Confidentiality safeguards | Standard 12 + Use of Technology | Alberta PIPA reasonable safeguards (HIA s.60 in custodian settings) | The privacy law is more specific on the security floor |
| Record keeping for email | Standard 7 + Use of Technology | Alberta PIPA (HIA only in custodian settings) | CAP SOP 7.4 sets a minimum 10 years after the last professional service for adult records; PIPA governs private practice retention |
| Privacy Impact Assessment | Not required by CAP | HIA s.64 in custodian settings; not required under PIPA | HIA only, and only when it reaches you as a custodian or affiliate; CAP and PIPA have no equivalent |
The short version: CAP sets the professional standard. For solo private practice, Alberta PIPA is the legal floor on the privacy side. HIA enters when you work as an affiliate inside a custodian organization. When the layers overlap, you follow both, and you start by knowing which privacy law actually binds your setup.
Practical steps for Alberta therapists
These steps address CAP’s practice standards, Alberta PIPA, and (where it reaches you) HIA. If you’re a psychologist registered with CAP and you use email to communicate with clients, steps 1, 3, and 4 apply to everyone. Step 2 (the PIA) applies when HIA reaches you as an affiliate inside a custodian organization; solo private practice falls under PIPA, which has no PIA requirement.
Step 1: Review your email encryption against your reasonable safeguards duty
Check whether your email encrypts messages containing health information. Standard Gmail uses opportunistic TLS, which means encryption depends on the recipient’s server supporting it. There’s no guarantee. Your reasonable safeguards duty (Alberta PIPA in solo private practice, HIA s.60 where you work as an affiliate of a custodian) means you need a system where encryption isn’t left to chance.
Look at your current setup and ask: if a client’s health information is in this email, is it encrypted end to end or at minimum through a secure client portal? If the answer is no, or “it depends,” that’s the gap.
Step 2: Complete and submit a PIA to OIPC Alberta
The PIA duty under HIA s.64 binds custodians. If you work inside a custodian organization (a clinic with physicians, or AHS) as an affiliate, the custodian’s system needs a PIA before implementation, and your email setup is part of that. If you run a solo private practice, you are not a designated custodian, so HIA s.64 does not require you to file a PIA, and Alberta PIPA imposes no PIA at all. Either way, knowing which side you sit on is the first step.
OIPC Alberta provides PIA guidance for custodians, including the PIA Requirements Guide (HIA) and a Submission Assessment Tool, on their PIA resources page. It does not publish an HIA PIA template (the posted template and completion guide are for POPA public bodies). The submission goes to OIPC for review and comment.
Step 3: Document consent for electronic communication
CAP’s Use of Technology guideline expects informed consent that specifically addresses electronic communication. This is separate from your general consent for services. The consent should cover:
- What electronic channels you use (email, video, messaging)
- The risks of each channel (email may not be fully encrypted, messages could be misdirected)
- Alternatives to electronic communication
- The client’s right to withdraw consent
Keep the signed consent in the client’s clinical record. CAP’s record keeping standards, Alberta PIPA, and HIA (where it reaches you as an affiliate of a custodian) all expect this documentation to be accessible and retained.
Step 4: Set up an audit trail for email containing health information
Create a log that tracks email communications involving health information. At minimum, record the date, recipient, subject or purpose, and whether the email contained individually identifying health information.
CAP’s Standards of Practice require adequate records of professional activities. HIA’s accountability provisions expect custodians to demonstrate compliance. An audit trail satisfies both.
If you’re maintaining this manually (a spreadsheet, a note in the client file), it works but it’s tedious. It’s also the kind of task that gets skipped when you’re between sessions.
How CAP compares to CRPO and CHCPBC
Alberta isn’t the only province with college level practice standards that affect email. Here’s how CAP’s approach sits alongside the other two major regulatory bodies for psychotherapy and psychology.
For the underlying provincial privacy law layer each college standard sits on top of, see our provincial privacy law comparison.
| College | Province | Electronic practice standard | Specificity | Status |
|---|---|---|---|---|
| CRPO | Ontario | Standard 3.4 (Electronic Practice) | High: seven clause standard backed by a six page guideline, specific consent requirements, technology categories, insurance requirements | Active |
| CAP | Alberta | Use of Technology guideline | Moderate: principles based, defers technical specifics to the privacy law (Alberta PIPA for private practice, HIA for custodians) | Active (updated Sept 2024) |
| CHCPBC | BC | TBD | TBD: psychotherapy regulation begins Nov 29, 2027 | Pending |
CRPO’s electronic practice standards are the most detailed of the three. CRPO names what “secure electronic communication” means, specifies what informed consent for electronic practice must include, and requires professional liability coverage to explicitly cover electronic services. If you practice in both Ontario and Alberta, CRPO’s standards are the stricter set.
The College of Health and Care Professionals of BC (CHCPBC) will begin regulating psychotherapists on November 29, 2027. What their electronic practice standards will look like is still unknown. BC practitioners using email for health information are currently governed by BC’s Personal Information Protection Act (PIPA) on the legal side, with no college level electronic practice standard yet in place.
For a broader look at how provincial email privacy laws across Canada compare, including the privacy legislation that sits beneath each college’s standards, see the cross provincial guide.
What this guide doesn’t cover
A few things that fall outside the scope of this post:
- Google Workspace admin console settings for Alberta: the technical configuration steps for locking down your Google Workspace are covered in separate guides, not here
- HIA breach notification requirements: HIA has specific breach reporting rules (including mandatory notification to OIPC Alberta). Those deserve their own treatment.
- CAP’s expanded scope timeline: the details of when and how counselling therapists will come under CAP regulation are still developing. We’ll cover that in a dedicated post when the timeline firms up.
- Telehealth and video communication: CAP’s Use of Technology guideline covers telepsychology in addition to email. This post focuses on the email and digital communication requirements only.
This is an Alberta specific guide. If you practise in Ontario, start with CRPO electronic practice standards. If you practise across provinces, the cross provincial email privacy guide covers the overlap.
Key takeaways
- CAP Standards 3, 7, and 12 (consent, records, confidentiality) apply to email communication with clients
- The Use of Technology guideline (Sept 2024) adds expectations for informed consent and confidentiality in electronic communication
- HIA s.60 requires reasonable administrative, technical, and physical safeguards (not encryption specifically); HIA s.64 requires a PIA before implementing any system handling health information. These bind custodians, so they reach a private practice psychologist mainly as an affiliate of a custodian
- Alberta is the only province that mandates a PIA submission before email system implementation
- CAP’s standards are principles based; the privacy law provides the legal specifics (Alberta PIPA for private practice, HIA for custodians and their affiliates)
Curio encrypts every client email and logs every send in a Canadian audit trail. Your Gmail stays the same. Join the waitlist.
Curio is designed to encrypt outbound email and maintain a Canadian audit trail. It is not a substitute for professional legal or compliance advice. Consult a qualified privacy professional for your specific situation.
This content is for informational purposes only and does not constitute legal advice. Privacy regulations vary by province and are subject to change. Verify current requirements with your provincial regulatory body.
Coming soon
Gmail encryption, built for Canadian therapists.
