CRPO vs CAP vs CHCPBC: college email requirements
Updated
- Ontario (CRPO), Alberta (CAP), and BC (CHCPBC) each set college level standards for how therapists handle email and digital communication
- CRPO has the most detailed electronic practice standard (Standard 3.4), CAP covers digital communication through a Use of Technology guideline, and CHCPBC is still developing psychotherapy specific standards ahead of November 2027
- All three expect security measures proportionate to the sensitivity of client information, along with informed consent and documentation, but the terminology and specificity vary and none of them reduces to a single named encryption rule. CRPO’s electronic practice standard is the most explicit; CHCPBC’s psychotherapy specific standards are still in development ahead of November 2027, so treat that column as provisional
- Each college’s standards layer on top of the provincial privacy law: PHIPA in Ontario, Alberta PIPA in Alberta (with HIA reaching custodians and their affiliates), and BC PIPA in BC, creating two separate sets of obligations
You’ve read the privacy law guides, including the PHIPA compliance baseline for Ontario email. You know the Personal Health Information Protection Act (PHIPA) covers Ontario, that in Alberta the Personal Information Protection Act (Alberta PIPA) covers therapists in private practice while the Health Information Act (HIA) binds designated custodians and their affiliates, and that BC’s Personal Information Protection Act (PIPA) covers BC. But the privacy law isn’t the only rulebook governing your inbox.
Each province also has a regulatory college that publishes its own practice standards for therapists. Those standards address electronic communication, and they don’t all say the same thing. CRPO in Ontario dedicates an entire standard to electronic practice. CAP in Alberta covers technology use through a separate guideline. CHCPBC in BC is still building the regulatory framework for psychotherapists who won’t be regulated until November 2027.
This guide compares all three side by side. If you’ve already read the individual deep dives on CRPO electronic practice standards, CAP practice standards for Alberta, or CHCPBC psychotherapy regulation, this is the piece that ties them together.
The comparison table
| Dimension | CRPO (Ontario) | CAP (Alberta) | CHCPBC (BC) |
|---|---|---|---|
| Full name | College of Registered Psychotherapists of Ontario | College of Alberta Psychologists | College of Health and Care Professionals of BC |
| Who they regulate | Registered Psychotherapists (RP); “Registered Mental Health Therapist” is a restricted title under the Psychotherapy Act, 2007, but its use is deferred | Psychologists; expanding to counselling therapists | 9 professions currently; psychotherapists joining Nov 29, 2027 |
| Electronic practice standard | Standard 3.4 (Electronic Practice), seven clauses with a six page guideline | Use of Technology guideline (Sept 2024), general practice standard | Harmonized practice standards in effect since April 1, 2026; no psychotherapy specific standard yet |
| Standard specificity | High. Addresses electronic communication, telehealth, electronic records, and liability insurance in detail | Moderate. Covers telepsychology, informed consent for technology, confidentiality, and social media | Developing. Existing standards for other professions provide general technology guidance |
| Encryption requirement | Technology must be “secure, confidential, and appropriate” for client needs | Use of Technology guideline gives its own security guidance (encryption when feasible, trusted and secure networks); HIA s.60 safeguards bind custodians, while CAP psychologists in private practice fall under Alberta PIPA | EPS Privacy standard 3.1 requires reasonable administrative, technical, and physical safeguards; psychotherapy specific requirements pending |
| Consent for electronic communication | Required (3.4.2). Informed consent for electronic media, separate from general PHIPA consent; the guideline lists agreement elements such as platform, risks and limitations, confidentiality measures and limits, and practice policies. The right to withdraw sits in Standard 3.2 | Required. Informed consent covering risks of electronic communication, available alternatives, and right to withdraw at any time | Existing consent requirements cover information collection and disclosure; psychotherapy specific electronic consent requirements pending |
| Documentation requirements | Treatment related email correspondence must be part of the clinical record. Electronic practice policies must be documented | Record keeping standards expect documentation of communications containing health information. Audit trail expected | Documentation requirements for currently regulated professions apply; psychotherapy specific requirements pending |
| Audit trail expectations | Email correspondence that is part of treatment must be logged as part of the clinical record | CAP expects accountability documentation; the privacy law adds to it (Alberta PIPA for private practice, HIA in custodian settings) | Not yet specified for psychotherapists |
| Privacy law layer | PHIPA (Personal Health Information Protection Act, 2004) | Alberta PIPA (Personal Information Protection Act, S.A. 2003) for private practice; HIA (Health Information Act, R.S.A. 2000) for designated custodians and their affiliates | PIPA (Personal Information Protection Act, S.B.C. 2003) |
| Breach notification | Mandatory under PHIPA s.12(2), “at first reasonable opportunity” | HIA s.60.1 (“as soon as practicable”) binds custodians, so it reaches private practice psychologists as affiliates; Alberta PIPA separately requires private sector organizations to notify the Commissioner where a breach creates a real risk of significant harm | Not mandatory under BC PIPA; voluntary, with OIPC BC recommending notice on a risk of significant harm (BC’s mandatory regime is FOIPPA s.36.3 for public bodies) |
| PIA requirement | Recommended by IPC Ontario; not mandatory to submit | Mandatory under HIA s.64 for custodians (submitted to OIPC Alberta before implementation), reaching private practice psychologists as affiliates; not required under Alberta PIPA for solo private practice | Not required under PIPA for private sector |
| Regulation maturity for psychotherapy | Established. CRPO has regulated psychotherapists since 2015 | Established for psychologists. Expanding to counselling therapists | Psychotherapy regulation begins November 29, 2027 under the Health Professions and Occupations Act (HPOA) |
Where the three colleges agree
The specific language differs across provinces, but the direction is consistent: all three colleges expect therapists to protect electronic communication.
Encryption. Two of the three colleges name encryption explicitly. CRPO’s Standard 5.6 commentary lists electronic safeguards (“Firewalls, encryption, virus protection, system security updates”) and references “encrypted electronic transmission”; the numbered clause 5.6.1 sets the general duty to protect personal health information. CAP’s September 2024 Use of Technology guideline directs psychologists to “use encryption when sending protected and private information over social media when feasible,” and its standards expect password and encryption controls for electronic records. CHCPBC’s current Ethics and Practice Standards do not use the word, requiring reasonable administrative, technical, and physical safeguards (Privacy standard 3.1) pending psychotherapy specific standards under HPOA. The direction is consistent across all three: encryption is treated as a baseline expectation, even where only two colleges name it.
Consent before electronic communication. All three colleges expect you to get consent before communicating with clients electronically. The detail of that consent varies (more on that below), but the principle is shared: clients should know you’re using electronic channels, understand the risks, and agree to it.
Documentation. Each college expects that your email practice leaves a trail. CRPO is the most prescriptive here (email as part of the clinical record), but CAP and CHCPBC both expect you to demonstrate accountability through documentation.
Deference to provincial privacy law. None of these colleges replace the privacy law. They add to it. CRPO’s Standards 3.4 (Electronic Practice) and 5.6 (Record Storage, Security, and Retrieval) build on PHIPA. CAP’s Standards of Practice and Use of Technology guideline build on Alberta PIPA for private practice, and on HIA where a psychologist works as an affiliate inside a custodian organization. CHCPBC will build on PIPA. The privacy law is the floor. The college raises it.
Where they differ
The differences come down to specificity, scope, and timing.
CRPO: the most detailed standard
CRPO is the only college of the three with a standalone electronic practice standard. Standard 3.4 sets out seven clauses (3.4.1 to 3.4.7), backed by a six page Electronic Practice Guideline. It covers secure technology, informed consent for electronic channels, professional liability insurance for electronic services, information about technology used in the therapeutic relationship, jurisdictional licensing (3.4.5), keeping correspondence in the record (3.4.6), and computer generated assessments (3.4.7).
The informed consent requirement under Standard 3.4 goes further than “get consent.” It’s a multi element process that must cover which electronic channels you use, the risks of each, limits of confidentiality in electronic communication, available alternatives, and the client’s right to withdraw consent. This is separate from general PHIPA consent for the collection, use, and disclosure of health information.
Standard 3.4 also requires that treatment related email correspondence be part of the clinical record. If you email a client about a session time and the email references their treatment, it goes in the file.
For the full breakdown: CRPO electronic practice standards.
CAP: general standards with a technology guideline
CAP doesn’t have an electronic practice standard at the same level of detail as CRPO. Instead, CAP publishes a Use of Technology practice guideline (updated September 2024) that covers telepsychology requirements, informed consent for technology use, confidentiality in electronic communication, and social media.
CAP’s informed consent for electronic communication follows a similar pattern to CRPO: clients must understand the risks, know their alternatives, and have the right to withdraw. But the guideline is less prescriptive about exactly what that consent document must contain.
Where the privacy law side differs is the PIA. HIA’s mandatory PIA requirement (s.64) means a custodian must complete and submit a Privacy Impact Assessment to the Office of the Information and Privacy Commissioner of Alberta (OIPC) before implementing any new system for health information. Psychologists in private practice are not designated custodians, so that filing duty does not bind them, and Alberta PIPA imposes none. CRPO has no equivalent mandatory submission requirement either.
CAP is also expanding its regulatory scope. Counselling therapists in Alberta will come under CAP regulation, which means more practitioners will need to meet both CAP practice standards and the privacy law that binds them: Alberta PIPA in private practice, with HIA email requirements reaching them as affiliates inside custodian organizations.
For the full Alberta guide: CAP practice standards for Alberta.
CHCPBC: building the framework
CHCPBC is in a different position than CRPO and CAP. Psychotherapists aren’t regulated in BC yet. Part 10 of the Health and Care Professionals Regulation (B.C. Reg. 131/2025), made under the Health Professions and Occupations Act (HPOA) and approved July 16, 2025, comes into force November 29, 2027, starting psychotherapy regulation under CHCPBC.
CHCPBC currently regulates nine other professions (including psychologists, occupational therapists, and physical therapists). It replaced the seven legacy standard sets with one harmonized set of Ethics and Practice Standards, in effect since April 1, 2026, that applies across all regulated professions.
What does this mean for psychotherapists? The practice standards that will apply after November 2027 don’t exist yet in their final form. CHCPBC’s existing standards for other professions address technology use and security obligations in general terms, but there is no published psychotherapy specific electronic practice standard comparable to CRPO’s Standard 3.4.
Until November 2027, BC therapists who aren’t members of another regulated health profession follow PIPA alone. After 2027, CHCPBC will add a college layer on top. Based on the direction of the harmonized standards work, those standards will cover electronic communication, but the specifics haven’t been finalized.
For more on the BC timeline: CHCPBC psychotherapy regulation and psychotherapist protected title in BC.
Which privacy law sits under each college
Your college standard doesn’t replace the privacy law. It layers on top.
| College | Privacy law | Key security section | Relationship |
|---|---|---|---|
| CRPO (Ontario) | PHIPA | s.12(1): “reasonable steps” to protect PHI | Standard 3.4 adds electronic practice requirements beyond PHIPA’s general obligation |
| CAP (Alberta) | Alberta PIPA for private practice; HIA for designated custodians and their affiliates | PIPA s.34: “reasonable security arrangements”; HIA s.60 safeguard duty in custodian settings | CAP’s Use of Technology guideline supplements whichever privacy law binds your setting; HIA’s mandatory PIA (s.64) applies only to custodians and affiliates |
| CHCPBC (BC) | PIPA | s.34: “reasonable security arrangements” | College standards (once finalized for psychotherapists) will add profession specific requirements on top of PIPA’s general obligation |
The two layer model works the same way in each province. The privacy law creates the legal floor: encrypt, safeguard, get consent, notify on breach. The college standard raises the bar for your specific profession: document your electronic practice policies, get informed consent specific to electronic channels, keep email correspondence in the clinical record.
If you’ve already read the privacy law comparison across Canada, that post covers the first layer. This post covers the second.
What this means for your email setup
Regardless of which college you’re registered with (or will be registered with in 2027), the practical requirements converge on the same set of actions.
Encryption is non negotiable across all three provinces. The legal language varies, the interpretation doesn’t. If your email contains health information, it needs encryption that you control. Gmail’s default TLS encryption is not sufficient because it depends on the recipient’s server configuration.
Consent documentation needs to cover electronic communication specifically. A general privacy notice isn’t enough for any of the three colleges. You need a separate consent process for electronic channels. CRPO is the most detailed about what that consent must include (five elements). CAP and CHCPBC are less prescriptive, but the expectation is the same: clients should know how you’ll communicate electronically, what the risks are, and that they can opt out.
Your email needs an audit trail. CRPO is explicit: treatment related email goes in the clinical record. CAP expects documentation of health information handling. The audit trail isn’t optional in any province.
Alberta affiliates: don’t skip the PIA. This is the biggest practical difference between the three provinces, but it turns on who you are under HIA. The PIA duty under s.64 binds custodians, so it reaches you when you work as an affiliate inside a custodian organization, and the custodian’s system needs a PIA submitted to the OIPC before implementation. Solo private practice falls under Alberta PIPA, which has no PIA requirement. Ontario recommends PIAs but doesn’t mandate submission. BC doesn’t require them under PIPA for private sector.
BC practitioners: start documenting now. You have until November 29, 2027 before CHCPBC starts regulating psychotherapists. Use the time. Build your electronic communication policies, set up your consent documentation, get your encryption in place. When the college standards land, you’ll be updating existing documentation instead of starting from scratch.
Frequently asked questions
Which college regulates psychotherapists in Ontario?
The College of Registered Psychotherapists of Ontario (CRPO) regulates Registered Psychotherapists (RP) in Ontario. “Registered Mental Health Therapist” is a restricted title under the Psychotherapy Act, 2007, but CRPO has deferred its use, so no one currently practises under it. CRPO’s Standard 3.4 sets the electronic practice requirements for registrants, including email.
Does CAP regulate counselling therapists?
CAP is expanding to include counselling therapists under its regulatory scope. Currently, CAP regulates psychologists in Alberta. When counselling therapists are regulated under CAP, they will need to meet the same practice standards and privacy law obligations that psychologists do: Alberta PIPA plus CAP standards in private practice, with HIA reaching them as affiliates inside custodian organizations.
When does CHCPBC start regulating psychotherapists?
November 29, 2027, under the Health Professions and Occupations Act (HPOA). Until that date, BC therapists who aren’t members of another regulated health profession follow PIPA without a college layer on top.
Do I need to follow both my college standards and my provincial privacy law?
Yes. The privacy law (PHIPA in Ontario; Alberta PIPA in Alberta, with HIA in custodian settings; BC PIPA in BC) is the legal floor. Your college standards add profession specific requirements on top. Both apply simultaneously. For example, an Ontario registered psychotherapist must meet PHIPA’s s.12(1) obligation to take reasonable steps to protect PHI and CRPO Standard 3.4’s requirement for secure electronic communication, informed consent for electronic channels, and documentation of email correspondence as part of the clinical record. The college standard never replaces the privacy law. It adds to it.
Curio encrypts every client email and logs every send in a Canadian audit trail, whichever province your practice calls home. Your Gmail stays the same. Join the waitlist.
This content is for informational purposes only and does not constitute legal advice. Privacy regulations vary by province and are subject to change. Verify current requirements with your provincial regulatory body.
Coming soon
Gmail encryption, built for Canadian therapists.
