PHIPA compliance checklist for therapists (2026)
A PHIPA checklist written for a hospital privacy program won’t do much for you. It asks about designated privacy officers, departmental access reviews and board level reporting. None of that describes a therapist working alone with a laptop and a Gmail account.
This one is written for that practice. It’s Ontario scoped, it assumes you hold your own client records, and every item is something you can check this afternoon.
One correction first, because it changes what the list is for. PHIPA doesn’t mention encryption. Section 12(1) asks for steps that are reasonable in the circumstances, and it names risks rather than technologies. Encryption comes in through Ontario’s privacy commissioner: its guidance on emailing health information says you should encrypt email with clients where you can, and that before you use unencrypted email you must tell clients about your written email policy and get their consent. The Act and the guidance are different sentences, and the difference is what you’d be asked about afterwards.
Who this checklist is for
| Written for | Not written for |
|---|---|
| A solo or small private practice in Ontario | A hospital, agency or community health centre privacy program |
| A therapist who holds their own client records | A therapist working as an agent inside someone else’s practice |
| Email, records, and the systems around them | Board level privacy governance and departmental access audits |
The middle row matters most. If you work inside an organization that holds the records, PHIPA s.17(1) keeps that organization responsible for the information in its custody or control, and lets its agents handle it on the organization’s behalf only under the conditions the section sets out. Your obligations then run through their practices.
Everything below assumes the other case: the records are yours, and so is the judgment call on every line.
What PHIPA actually says about security
“A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information in the custodian’s custody or control is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal.” (PHIPA s.12(1))
Read it twice. It sets a standard, reasonable in the circumstances, then names the harms you’re protecting against. No product, no key length, no vendor, no certification.
That’s not a loophole. It’s a higher bar than a rule, because a rule is satisfied by doing one thing and reasonableness is assessed against everything you did and didn’t do.
Here’s where each named harm shows up in a practice of one.
| What s.12(1) names | Where it happens in a solo practice |
|---|---|
| Theft | A laptop or phone taken from a car or a shared office |
| Loss | A USB stick, a paper intake form, a phone that dies holding the only copy |
| Unauthorized use | Opening the file of a client you’re no longer seeing, for a reason that isn’t care |
| Unauthorized disclosure | An email to the wrong address, or a reply-all on a referral thread |
| Unauthorized copying | A record forwarded to a personal account, or synced to an unmanaged cloud folder |
| Unauthorized modification | A note edited months later with nothing left showing what the original said |
| Unauthorized disposal | A laptop sold or recycled with client files still on the drive |
So why is encryption on every checklist?
Because for email, the risks s.12(1) names are the ones encryption addresses. A message crossing the open internet in plain text is exposed to interception, and one landing at the wrong address is exposed to whoever opens it.
Your college says so too, in different words. The College of Registered Psychotherapists of Ontario (CRPO) sets it out in Standard 5.6 on record storage, security and retrieval, which names firewalls, encryption, virus protection and system security updates among electronic safeguards. On transmission it asks registrants to make reasonable efforts to keep client records secure, and gives two illustrations of what that effort can look like: mail or courier with tracking, or encrypted electronic transmission.
Note the verb. The standard names encryption inside a reasonable efforts duty. It doesn’t require it. That leaves you latitude, which is only comfortable if you can show how you used it.
Which is what the list below is for.
The checklist, step by step
Twelve checks in an order that builds, because you can’t protect information you haven’t located. Sections are PHIPA unless noted.
| # | The check | Where it comes from |
|---|---|---|
| 1 | Where information lives | s.12(1) |
| 2 | Practices written and followed | s.10(1), s.10(2), s.10(3) |
| 3 | Public statement | s.16(1) |
| 4 | Consent | s.18(1), s.18(2), s.20(1), s.20(2), s.37(1)(a), s.38(1)(a) |
| 5 | How information leaves | s.12(1) |
| 6 | Electronic safeguards | CRPO 5.6 |
| 7 | Who can open what | CRPO 5.6 |
| 8 | Backups and outage fallback | CRPO 5.6 |
| 9 | What the record proves | CRPO 5.6, CRPO 5.1 |
| 10 | Retention and disposal | s.13(1), CRPO 5.1 |
| 11 | Access requests | s.52(1), s.54(1) to s.54(3), s.55(1), s.13(2) |
| 12 | First hour after a breach | s.12(2), s.12(3) |
1. Write down where client information actually lives
Inventory first, because s.12(1) reaches everything in your custody or control, including the copies you’ve stopped thinking about.
Walk it physically: inbox, sent items, laptop, phone, backup drive, cloud folders, practice management account, filing cabinet, voicemail, and any device you’ve retired.
The test is blunt. Can you name every place a client’s name sits beside a clinical detail? A copy you can’t name is one you can’t protect, and one you can’t produce when a client asks for their record.
2. Write your information practices down, then check you follow them
PHIPA s.10(1) asks a custodian to have information practices in place that comply with the Act. Section 10(2) then asks you to comply with your own practices. Two duties, and the second is the one that catches people.
A policy you wrote three years ago and quietly stopped following is worse than no policy: the gap between document and practice is what gets examined.
Section 10(3) adds that where you use electronic means to collect, use, modify, disclose, retain or dispose of personal health information, you comply with the prescribed requirements, if any.
Your check: one dated document covering how information is collected, used, kept, disclosed and destroyed. Then read it line by line and mark everything you don’t do.
3. Publish your written public statement
This one gets skipped, and it’s one of the few places PHIPA asks you for something in writing.
Section 16(1) asks you, in a manner practical in the circumstances, to make available to the public a written statement that:
- gives a general description of your information practices
- describes how to contact your contact person, or you
- describes how someone obtains access to, or requests correction of, their record
- describes how to complain to you and to the Information and Privacy Commissioner of Ontario
Your check: open your website’s privacy page and see whether all four are there. A cookie notice from a template covers none of them.
4. Check what you’re treating as consent
Section 18(1) sets the elements: consent must be the individual’s, knowledgeable, related to the information, and not obtained through deception or coercion. Section 18(2) says it may be express or implied.
No writing requirement appears anywhere in that section. PHIPA doesn’t ask you for a signed form. Your college may expect documentation, which is a separate obligation from a separate source.
Section 20(2) carries the implied consent rule for providing health care, and it stops where you are aware the individual has expressly withheld or withdrawn that consent. Section 20(1) lets you assume a consent you obtained is valid and unwithdrawn unless it isn’t reasonable to assume so.
Then the one people miss, and it has two limbs. Under s.37(1)(a) you may use personal health information for the purpose it was collected for and the functions reasonably necessary to that purpose, unless the individual expressly instructs otherwise. Under s.38(1)(a) you may disclose it to another custodian for care, but only where the disclosure is reasonably necessary for providing that care and it is not reasonably possible to obtain the individual’s consent in a timely manner, and never where the individual has expressly instructed you not to. Leaving something out of a referral letter is the disclosure limb.
Your check: if a client told you last spring to leave something out of a referral letter, can you find that instruction today without rereading the file?
5. Check how client information leaves your practice
Step 1 was information at rest. This one is about motion, which is where s.12(1)‘s unauthorized disclosure and copying happen.
List every outbound channel: ordinary email, attachments, a client portal, text, fax. For each, answer two questions. What protects the message in transit? And what happens when the receiving end won’t negotiate a secure connection, which for ordinary email is decided silently by a server you don’t control?
If email is the main channel, PHIPA email requirements for Ontario therapists covers the mechanics and PHIPA compliant email options compares what’s available. For a portal, work through the PHIPA compliant client portal checklist.
6. Check your electronic safeguards against what CRPO names
Standard 5.6 gives you a list to check against, which is more than the statute does. Its electronic safeguards commentary names firewalls, encryption, virus protection and system security updates. For credentials it names user ID and password protection.
Worth knowing: no multi factor requirement appears in Standard 5.1 or 5.6. Turning it on goes beyond what CRPO names, and it’s the cheapest safeguard on a Google account, which is why it belongs on your list even though nobody’s asking.
Your check: firewall on, operating system and browser current, antivirus where it applies, a unique password on every account that touches client information, and multi factor on the account holding your email.
7. Check who can open what
Standard 5.6’s administrative safeguards name need to know access. In a practice of one that sounds like nothing, right up until you count.
A bookkeeper with a shared login. A virtual assistant with inbox delegation. An old phone still signed in, in a drawer. A note taking app you tried once and never disconnected.
Your check: list every human and device that can reach your inbox and records, then remove what doesn’t need to be there. Check delegated access and connected apps while you’re in the settings. That’s where access outlives the reason it was granted.
8. Test a restore, and write down your fallback
Standard 5.6 names automated backups at reasonable intervals, and recovery tests. Those are two things. A backup you’ve never restored from is a hypothesis, not a safeguard.
The same standard names an alternate recordkeeping method for system failure, and that one takes five minutes to write. If your practice management tool and your email are both down on a Tuesday morning, what do you write notes on, and how does that get back into the record?
Your check: restore one real file and time it. Then put the outage fallback on one page, somewhere that isn’t the system it’s about.
9. Check your record can answer three questions
Standard 5.6’s demonstrating clause names maintaining records in a way that supports an audit trail. That’s an example of meeting 5.6.1, not a term of 5.6.1 itself, and the distinction is the standard’s own.
The commentary names what your record should be able to capture:
- the date, time and author of each entry, including changes that preserve the original entry
- who has viewed the record, and when
- a log of data exports and exchanges with other systems
On amendments, CRPO Standard 5.1 asks that the original entry stay legible and that the amendment show what changed, when, by whom, and why.
Your check: pick one file and answer all three from the system itself, not from memory.
10. Check retention and secure disposal
Section 13(1) asks that records “are retained, transferred and disposed of in a secure manner and in accordance with the prescribed requirements, if any.”
CRPO Standard 5.1 sets the period. Where the Registered Psychotherapist is the custodian, the clinical record is retained for at least 10 years from the date of the last interaction with the client, or 10 years from the client’s 18th birthday, whichever is later.
Two checks, not one. Do you know which files sit inside that window? And when a device leaves your possession, what happens to the copies on it? Unauthorized disposal is one of the harms s.12(1) names, and a recycled laptop is how it usually happens.
11. Rehearse an access request
Section 52(1) gives an individual a right of access to their own record, subject to that Part’s exceptions, including legal privilege.
Section 54(1) gives you three possible responses:
- make the record available and provide a copy on request, explaining terms, codes or abbreviations where reasonably practical
- give written notice that the record doesn’t exist or can’t be found after a reasonable search
- give written notice of a refusal, with reasons
Section 54(2) sets the clock at as soon as possible in the circumstances, and no later than 30 days. Section 54(3) lets you extend by up to a further 30 days in the listed circumstances, if you do it within the first 30. Under s.13(2), while a request is live you keep the record long enough for the person to exhaust their recourse.
Correction is the client’s move: under s.55(1) they request one in writing once access has been granted.
Your check: time yourself assembling one client’s complete record. If it takes a week when nobody’s waiting, 30 days is tighter than it sounds.
12. Know your first hour after a breach
Section 12(2) covers personal health information that’s stolen, lost, or used or disclosed without authority. You notify the individual at the first reasonable opportunity, and the notice has to say they’re entitled to complain to the Commissioner under Part VI.
Section 12(3) is conditional. Where the circumstances meet the prescribed requirements, you notify the Commissioner. Not every incident triggers that, and reading it as automatic is as much a mistake as ignoring it.
Your check: write down who you call, what you record, and where the notice wording lives. The first hour after a misdirected email is not when you want to be reading a statute.
What this checklist doesn’t cover
It isn’t a verdict, and no checklist can be. Reasonableness under s.12(1) is judged afterwards, against what a reasonable therapist in your position would have done at the time. What a list does is make sure you’ve looked at each surface and can say why you chose what you chose.
It’s also the privacy layer only. Your college’s record keeping, supervision and electronic practice standards sit on top of PHIPA, so CRPO’s practice standards are a separate afternoon.
If you practise outside Ontario
PHIPA is Ontario’s statute, and it isn’t the one governing you if your practice is elsewhere. Other provinces have comparable legislation with different section numbers, different thresholds and different regulators. In Alberta, for instance, a therapist in private practice is governed by Alberta’s PIPA together with the standards of their college, CAP for psychologists or ACSW for social workers, not by HIA. The guide to which privacy law applies across provinces sets out the comparison.
When to stop and get advice
Four situations are worth a phone call rather than a checkbox: an incident you’re not sure counts as a breach, a subpoena or court order, an access request you think you should refuse, and a group practice where it isn’t clear who holds the records. Those are legal questions, and nothing here is legal advice.
Frequently asked questions
Does PHIPA require encryption?
PHIPA itself doesn’t mention encryption. Section 12(1) asks for steps that are reasonable in the circumstances to protect personal health information against theft, loss and unauthorized use or disclosure, and it names no technology. Ontario’s privacy commissioner goes further in its guidance: you should encrypt email with clients where you can, and before you use unencrypted email you must tell clients about your written email policy and get their consent. That’s why encryption is on your checklist.
Does PHIPA require written consent?
No. Under s.18(2) consent may be express or implied, and s.18(1) sets the elements: it must be the individual’s, knowledgeable, related to the information, and free of deception or coercion. Nothing there prescribes a form. Your college may expect documentation, which is a separate obligation.
Do I need a privacy statement on my website?
PHIPA s.16(1) asks you to make a written statement available to the public, in a manner practical in the circumstances. It has four contents: a general description of your information practices, how to reach your contact person, how to get access or a correction, and how to complain to you and to the Commissioner.
How long do I have to answer a client’s request for their record?
As soon as possible in the circumstances, and no later than 30 days after you receive it, under s.54(2). You can extend by up to a further 30 days in the circumstances s.54(3) lists, and you have to do that within the first 30.
How long do I keep client records?
Where the Registered Psychotherapist is the custodian, CRPO Standard 5.1 sets retention at least 10 years from the last interaction with the client, or 10 years from the client’s 18th birthday, whichever is later. PHIPA s.13(1) adds that retention, transfer and disposal have to be secure.
Does finishing this checklist make my practice compliant?
No, and treat anyone who says otherwise with caution. A checklist tells you which surfaces you’ve looked at. Compliance is a set of practices you keep running, and reasonableness gets assessed afterwards against your circumstances. What the list gives you is a dated record that you looked.
Where this leaves you
An afternoon gets you through all twelve. What takes longer is the half that runs after you close the tab: the safeguard still on next March, and something that shows it was on this September.
Email is where that half tends to fail, because it’s the one surface where the safeguard depends on someone remembering at the moment of sending, under time pressure.
Curio holds every client email to Canadian mental health privacy law and keeps the record that it did. It works with the Gmail you already use, so there’s no migration and no second inbox.
Outbound messages are encrypted automatically, a withdrawn consent directive is denied rather than downgraded, and every send is logged in an audit trail hosted in Montreal. Standard is $15/mo CAD per therapist, in 12 of 13 provinces and territories, with Quebec on the roadmap pending Law 25 work. Start now.
Product disclaimer: Curio holds every client email to Canadian mental health privacy law and keeps the record that it did. It is not a substitute for professional legal or compliance advice. Consult a qualified privacy professional for your specific situation.
Regulatory content disclaimer: This content is for informational purposes only and does not constitute legal advice. Privacy regulations vary by province and are subject to change. Verify current requirements with your provincial regulatory body.
Now available
Your Gmail. Secure for Canadian mental health privacy law.
