CRPO Standard 3.4 requires secure electronic communication, informed consent for electronic channels, and copies of treatment related correspondence in the clinical record
These requirements layer on top of PHIPA and apply to every email containing client information
Standard 3.4’s informed consent for electronic communication is separate from general PHIPA consent
Treatment related email correspondence must be included in the clinical record
Your professional liability insurance must explicitly cover electronic services

CRPO Standard 3.4 requires Ontario registered psychotherapists to use secure electronic communication, obtain informed consent specific to electronic practice, and keep copies of treatment related correspondence in the clinical record. These requirements layer on top of PHIPA and apply to every email you send that contains client information.

You’re a registered psychotherapist in Ontario. You already know about PHIPA email requirements. But PHIPA isn’t the only rulebook that governs your inbox.

The College of Registered Psychotherapists of Ontario (CRPO) publishes its own practice standards, and Standard 3.4 covers electronic practice. It runs seven clauses, backed by a six page Electronic Practice Guideline, and it covers telehealth, electronic records, and electronic communication. Most therapists skim it during registration and never look at it again.

That’s a problem, because Standard 3.4 adds requirements that PHIPA doesn’t address directly. This guide translates the standard into specific email actions.

What is CRPO Standard 3.4?

CRPO Standard 3.4 is the electronic practice standard published by the College of Registered Psychotherapists of Ontario. It governs how registrants use communications technology (telephone, text, email, video calling) to provide assessment or treatment. The standard requires that registrants adhere to all professional standards whether practice is electronic, in person, or hybrid.

Standard 3.4 sits within the “Client-Therapist Relationship” section of CRPO’s practice standards. It doesn’t replace PHIPA. It builds on top of it.

Think of it this way: PHIPA tells you what the law requires for protecting health information. Standard 3.4 tells you what your college expects when you deliver therapy through technology. The two overlap, but Standard 3.4 reaches into areas that PHIPA leaves to professional judgment.

For email specifically, Standard 3.4 creates three obligations: secure communication, informed consent for electronic channels, and copies of treatment related correspondence in the clinical record. Each one affects how you set up and use your email.

What Standard 3.4 requires for email

Secure electronic communication

CRPO Standard 3.4 requires registrants to “take reasonable steps to ensure that the technology employed is secure, confidential, and appropriate given the needs of the client.”

Read that clause carefully, because the word most people expect is not in it. Standard 3.4 carries no encryption wording at all. It sets a reasonable steps duty about the technology you choose, and stops there.

The word sits in a different standard. Standard 5.6, Record Storage, Security, and Retrieval, names encryption in its Electronic Safeguards commentary, alongside firewalls, virus protection and system security updates. It then asks registrants to make reasonable efforts to keep client records secure during transmission or disclosure, and gives two illustrations of that effort: mail or courier with tracking, or encrypted electronic transmission. Note the verb. Standard 5.6 names encryption as a safeguard, inside a reasonable efforts duty. It does not require it.

Two standards, two jobs, and client email runs through both. CRPO’s Implementing Electronic Practice resource article adds direction on the 3.4 side: registrants should consider whether their communication tools protect information from unauthorized access.

So what does “secure” mean for your email in practice?

Standard email (Gmail, Outlook) uses TLS encryption in transit. That covers the “in transit” piece when both sender and recipient support TLS. But TLS alone doesn’t protect emails at rest on the server, and it doesn’t cover situations where the recipient’s email provider doesn’t support TLS.

PHIPA s.12(1) asks a custodian to take “steps that are reasonable in the circumstances” to protect personal health information against theft, loss and unauthorized use or disclosure. It names risks rather than technologies and doesn’t mention encryption. Ontario’s privacy commissioner does: its guidance on emailing health information says you should encrypt email with clients where you can. What it does mean in practice, read alongside what CRPO 5.6 names, is that client information wants protecting regardless of the recipient’s email setup. That points at either end to end encryption or a secure portal fallback for messages containing personal health information (PHI).

If you’re using Gmail without an encryption layer, that is the gap worth looking at, and it is a gap against the safeguards duty rather than against a rule that names a product. For a deeper look, see is Gmail PHIPA compliant.

CRPO Standard 3.4 requires registrants to “obtain informed consent from clients regarding the use of electronic communication media in the provision of services.” This consent is separate from general PHIPA consent for collecting and using health information. It must address the specific risks of electronic communication, including the limitations of confidentiality over email.

This is where Standard 3.4 goes further than most therapists realize. You may already have PHIPA consent for email in place, covering consent to collect, use, and disclose PHI. Good. But CRPO wants a second layer.

The electronic communication consent must be informed. That word “informed” is doing real work here. Your client needs to understand:

What electronic communication channels you’ll use (email, text, video)
The specific risks of each channel (email can be intercepted, forwarded, or stored on insecure devices)
The limitations of confidentiality when communicating electronically
What alternatives exist (in person, phone, secure portal), as good practice rather than a Standard 3.4 requirement
That they can withdraw consent for electronic communication at any time (Standard 3.2)

A generic “I consent to receiving emails” checkbox won’t satisfy this. The consent needs to demonstrate that the client understood the risks before agreeing. CRPO’s guideline calls for informed consent, with the client given information about the technology and its potential risks before agreeing.

If you need consent form language that covers both PHIPA and CRPO requirements, the client communication templates include versions you can use directly.

Documentation standards

CRPO Standard 3.4 requires registrants offering modalities involving written communication (including email) to “include copies of correspondence and treatment-related communication in the clinical record.” This creates a documentation obligation that goes beyond PHIPA’s general record keeping requirements.

This requirement catches therapists off guard. If you email a client about scheduling, that’s administrative. But if an email touches on treatment (a check in about symptoms, a homework assignment, a crisis response), Standard 3.4 says it belongs in the clinical record.

The question is how. Most therapists don’t have a system for capturing email content into their clinical records. Some copy and paste into their EHR. Some print emails to PDF. Some don’t capture them at all.

At minimum, save the treatment related emails themselves in the clinical record, as Standard 3.4.6 asks. A log of what was sent, when, and to whom helps you find them; the manual audit log for client records template walks you through setting one up in Google Sheets. It isn’t a substitute for the copies.

Where Standard 3.4 goes beyond PHIPA

Where Standard 3.4 goes beyond PHIPA
Requirement	PHIPA	CRPO Standard 3.4
Security safeguards	s.12(1): “steps that are reasonable in the circumstances” to protect PHI. Names no technology	3.4: technology must be “secure, confidential, and appropriate”. Names no technology either. Encryption is named in Standard 5.6, as a safeguard rather than a requirement
Consent for electronic communication	Not specifically required (consent covers collection, use, disclosure of PHI)	Required (3.4.2): informed consent specific to the electronic channel, including its potential risks. Withdrawal comes from Standard 3.2
Documentation of electronic communications	General record keeping under s.10	Specific: treatment related email correspondence must be included in clinical record
Competency in electronic practice	Not addressed	Not in the standard; CRPO’s Electronic Practice Guideline addresses competence
Professional liability coverage	Not addressed	Required: insurance must cover electronic services before treating clients electronically

PHIPA is the floor. Standard 3.4 adds height.

The most significant addition is the informed consent requirement for electronic communication itself. PHIPA covers consent to collect, use, and disclose personal health information. Standard 3.4 adds consent for the communication channel. You need both.

Here’s why that matters in practice: a therapist who has a signed PHIPA consent form but no electronic communication consent form has a gap. If a client later complains about a privacy issue with email, the PHIPA consent covers the fact that you collected their health information, but it doesn’t demonstrate that they understood and accepted the risks of email as the communication method.

Competency, insurance, and documentation specificity

CRPO expects you to understand the technology you’re using, not just turn it on and hope for the best. And your professional liability insurance needs to explicitly cover electronic services. If you started offering telehealth during COVID and never checked your policy, check it before your next electronic session.

Documentation specificity is another gap worth noting. PHIPA’s record keeping requirements under s.10 are general. Standard 3.4 names email explicitly. If you exchange treatment related emails with a client, those emails need to be in the clinical record. PHIPA wouldn’t necessarily flag a missing email log during an audit. CRPO might.

Practical steps for compliance

Here are six steps. Four map to a clause of Standard 3.4; the policy and disclaimer steps are good practice.

Step 1: Review your current email setup against the safeguards duty

Check whether your email encrypts messages containing PHI. If you use Gmail or Outlook without an encryption layer, the answer is likely no. Compare your setup against what PHIPA s.12(1) asks (reasonable steps against named risks) and what Standard 3.4 asks (secure, confidential and appropriate technology). Neither names encryption; Standard 5.6 does, as a safeguard.

What to look for: Does your email encrypt messages in transit? Does it protect content if the recipient’s server doesn’t support TLS? Is there a fallback (like a secure portal) for sensitive messages?

Draft a consent form that covers Standards 3.4.2 and 3.2. The form should explain which electronic channels you use, the risks of each channel, the limits of confidentiality, available alternatives, and the client’s right to withdraw consent. Our PHIPA and CRPO consent form template walks through each of those clauses with sample wording.

This form is separate from your general PHIPA consent. You can combine them into one document, but both sets of requirements need to be addressed. The client communication templates include a starting point.

Step 3: Document your electronic practice policies (good practice)

Tell clients your practice policies for electronic practice (payment, cancellations, what happens if the connection drops), as CRPO’s Electronic Practice Guideline suggests for the client agreement. Writing down which tools you use, why, how you protect client information in each one, and what you do when something goes wrong is good practice, not a Standard 3.4 requirement.

Step 4: Add email disclaimers to client facing messages

Include a confidentiality notice on emails that may contain or reference PHI. The disclaimer should remind the recipient that email may not be fully secure and direct misdirected messages to be deleted. This doesn’t fix an encryption gap, but it demonstrates awareness of the risk and satisfies part of Standard 3.4’s “appropriate” technology requirement.

Step 5: Set up an audit trail for email communication

Save treatment related email correspondence in the clinical record, as Standard 3.4.6 requires. A log helps you track it: the manual audit log for client records template gives you a Google Sheets based approach. Log the date, recipient, subject, and whether the email contained PHI.

Step 6: Review CRPO’s electronic practice guideline

Read the full CRPO Electronic Practice Guideline and the Standard 3.4 page on crpo.ca. This guide covers the email specific requirements, but Standard 3.4 also addresses telehealth, video calling, and electronic records. The full document gives you the complete picture.

How CRPO compares to CAP and CHCPBC

CRPO isn’t the only provincial college that sets expectations for electronic communication. The College of Alberta Psychologists (CAP) and the College of Health and Care Professionals of BC (CHCPBC) have their own standards, each shaped by their province’s privacy law.

How CRPO compares to CAP and CHCPBC
College	Province	Privacy law	Electronic practice standard	Status
CRPO	Ontario	PHIPA	Standard 3.4: detailed electronic practice requirements including secure communication, informed consent, and documentation	Active
CAP	Alberta	Alberta PIPA (HIA only for designated custodians)	Practice standards address electronic communication but without CRPO’s level of specificity for email	Active
CHCPBC	BC	PIPA (BC)	Ethics and Practice Standards in force since April 1, 2026 (Communication 5.1 names email); psychotherapists join on November 29, 2027	Active (psychotherapy from 2027)

If you practice in Alberta, CAP’s approach differs from CRPO’s. CAP has practice standards that cover electronic communication, but they don’t include the same level of specificity for email that CRPO Standard 3.4 does. Most Alberta therapists in private practice fall under Alberta PIPA, Alberta’s private sector privacy law, plus their college’s standards. HIA applies to designated custodians (physicians, nurses, pharmacists and others); it reaches a private practice therapist mainly when they work inside a custodian organization. We’ll cover that in detail in a companion piece on CAP practice standards for Alberta therapists (publishing later this month).

If you’re in BC, CHCPBC’s psychotherapy regulation doesn’t take effect until November 29, 2027. Once it does, CHCPBC’s Ethics and Practice Standards, including Communication 5.1 on email, will apply to you. Preparing early gives you a head start. Our guide to CHCPBC psychotherapy regulation covers what BC therapists need to prepare for.

For the full picture on how privacy laws differ across provinces, see email privacy laws across Canada.

FAQ

Does Standard 3.4 apply to all email or just email with PHI?

Standard 3.4 applies to all electronic communication used in the provision of psychotherapy services. The security duty in 3.4.3 matters most when email contains personal health information, but the consent and documentation requirements apply to your electronic communication practices as a whole.

You need both. PHIPA consent covers the collection, use, and disclosure of personal health information. CRPO Standard 3.4 requires separate informed consent for the use of electronic communication channels. The Standard 3.4 consent must address the potential risks of the technology. Standard 3.2 adds the rest of a valid consent, including that the client can revoke it.

What happens if I don’t comply with Standard 3.4?

CRPO can investigate complaints related to practice standard violations. Non compliance with Standard 3.4 could result in remedial measures, conditions on your registration, or disciplinary proceedings. That said, CRPO’s approach tends to be educational first. The risk isn’t just regulatory action. If a privacy breach occurs and your setup doesn’t meet Standard 3.4, the gap becomes evidence that you didn’t take “reasonable steps.”

Can I use regular Gmail and still meet Standard 3.4?

Standard 3.4 asks that the technology you employ be “secure, confidential, and appropriate given the needs of the client”, and it names no specific technology. Regular Gmail, without an encryption layer, is hard to defend against that clause for emails containing personal health information: it uses TLS in transit, which does not protect content at rest, and does not cover the case where the recipient’s provider doesn’t support TLS. An encryption layer closes that gap, and encryption is what Standard 5.6 names among its electronic safeguards. A secure portal fallback closes it too.

Where can I read Standard 3.4 directly?

The full text is on CRPO’s website at crpo.ca/practice-standards. CRPO also publishes an Implementing Electronic Practice resource article with practical guidance.

What this doesn’t cover

Standard 3.4 addresses more than email. Telehealth platforms, video calling security, cross border practice, and electronic clinical records all fall under its scope. This guide focused on the email requirements because that’s where most registered psychotherapists have the biggest gap between what they’re doing and what the standard expects.

If you’re looking for broader guidance on Ontario privacy law and email, start with the PHIPA email requirements guide. For consent specifically, the PHIPA consent for email guide walks through what PHIPA requires before you layer Standard 3.4 on top.

Curio encrypts the email you send your clients and logs each send in a Canadian audit trail. Start now.

This content is for informational purposes only and does not constitute legal advice. Privacy regulations and college practice standards are subject to change. Verify current requirements with CRPO and consult a qualified privacy professional for your specific situation.

CRPO electronic practice standards for email

What is CRPO Standard 3.4?