You practice in Ontario. Your new client lives in Calgary. After Friday’s session, you email her a brief summary and a homework worksheet.

Which privacy law just governed that email? PHIPA, because you’re the custodian in Ontario? Alberta’s HIA, because that’s where her PHI now sits on a device? Both?

The pandemic normalized this scenario. The compliance answer didn’t catch up.

There’s no Supreme Court decision squarely on point for private practice therapists doing cross provincial virtual work. What does exist is three provincial regimes and three regulators. Alberta PIPA and BC PIPA cap offence fines at the same $10,000 for an individual and $100,000 otherwise. PHIPA’s conviction fines go to $200,000 and $1,000,000, and the IPC can also levy administrative penalties. They overlap, but they don’t agree.

This guide walks through the analysis, the scenarios, and a defensible approach you can apply without re-deciding jurisdiction for every client.

Quick answer

When a therapist in one province treats a client in another, the therapist’s own province’s law always applies, and the client’s province’s law may also apply, so get advice. Whether a provincial privacy statute reaches a therapist in another province is unsettled.
Ontario PHIPA, Alberta HIA, and BC PIPA each set their own consent, safeguard, breach, and (for Alberta custodians under HIA) PIA obligations. Alberta private practices answer to Alberta PIPA.
The defensible operating model is to apply the higher of the applicable standards across encryption, consent, audit trail, and PIA, rather than re-deciding jurisdiction per client.
College registration (CRPO, CAP, CHCPBC) is a separate analysis from privacy law and follows its own province by province rules.

For the full provincial comparison, see our PHIPA vs HIA vs BC PIPA guide.

Which law applies to cross provincial email?

The short answer: potentially both. Sometimes three.

The therapist’s province treats the therapist as the regulated party

In Ontario, a registered psychotherapist sending PHI by email is a health information custodian under PHIPA s.3(1), read with the health care practitioner definition in s.2, and is bound by PHIPA’s safeguard, consent, and breach rules. In Alberta, a private practice therapist is not a HIA custodian; the governing privacy law is Alberta PIPA together with college standards, and HIA reaches the therapist only as an affiliate working inside a custodian organization.

In BC, a counselling therapist in private practice is an organization under BC PIPA.

The client’s province has its own claim

The client’s PHI lives on their device, on their email server, in their inbox.

Whether the client’s province’s privacy law reaches a therapist practising from another province is unsettled, so get advice. Professional regulation is clearer: it usually treats practice as happening where the client is, so the client’s province can require you to register there or follow its rules, and your home college still binds you.

Where PIPEDA fits

Then there’s PIPEDA. PIPEDA applies to commercial activity, and where a province’s private sector or health sector law has been designated substantially similar by the Governor in Council, activity within that province is largely carved out of PIPEDA’s reach.

The designated laws relevant here are Ontario’s PHIPA, Alberta’s PIPA, and BC’s PIPA. The practical effect: provincial law governs PHI handled by therapists in private practice in these provinces, and PIPEDA is not the operative statute in the run of cases. The carve out does not extend to personal information that moves across a border in a commercial transfer, where PIPEDA can still apply.

The federal Privacy Commissioner can still take an interest in interprovincial transfers, but the rules you build to should be provincial. In practice, that means a therapist’s compliance program references the provincial statute first, then notes how PIPEDA aligns with it as a federal backstop. For the narrower question of when PIPEDA is the operative law rather than the backstop, that comparison has its own guide.

Definition: substantially similar designation

A province’s private sector or health sector privacy law is designated “substantially similar” under PIPEDA when the Governor in Council recognizes it, by Order in Council, as equivalent in protection. The designated laws here are Ontario’s PHIPA, Alberta’s PIPA, and BC’s PIPA. In a Curio context, that means PIPEDA steps back in favour of those laws for therapists in private practice, while still reaching personal information transferred across a border in a commercial transaction.

What no Canadian appellate court has done is resolve the overlap squarely for private practice psychotherapy. IPC Ontario, OIPC Alberta, and OIPC BC have each published guidance on cross border PHI handling and electronic communication.

None of them has issued binding guidance on which provincial statute wins when therapist and client are in different provinces. We’re not going to invent a rule that the regulators themselves haven’t settled.

What you can do is build to the stricter standard and stop asking the question for every email. We get to that below.

Common cross provincial scenarios

Most therapists doing cross provincial work fall into a handful of repeating patterns. Here are the four that come up most often and the laws that apply to each.

Scenario summary

Scenario summary
Therapist location	Client location	Laws that can apply	Stricter requirement to plan around
Ontario	Alberta	PHIPA (binds you); Alberta PIPA may reach the client side (unsettled). CAP standards bind you only if you’re registered with CAP	Confirm CAP registration or practice permission for the client’s province; a written PIA is prudent risk management, though HIA s.64 binds Alberta custodians, not you.
Ontario	British Columbia	PHIPA + BC PIPA	PHIPA’s express instruction (lock box) provisions, ss.37(1)(a), 38(1)(a) and 50(1)(e), are the strictest consent regime of the three.
Alberta	Ontario	Alberta PIPA / CAP standards (your side) + PHIPA (client side)	PHIPA s.12(2) triggers on personal health information stolen, lost, or used or disclosed without authority, with no harm test at all, where Alberta PIPA s.34.1 turns on a real risk of significant harm.
Any province	Client moves provinces mid course	Therapist’s own province’s law continues to govern the therapist	Re-confirm consent and update audit trail jurisdiction tags. The new province’s statute binds custodians and organizations in that province, not an out of province therapist.

Ontario therapist, Alberta client

PHIPA names you a custodian. HIA designates a defined list of Alberta providers and organizations as custodians, and it reaches a private practice therapist only as an affiliate working inside one of those custodian organizations. A solo Ontario therapist treating an Alberta client is not an Alberta custodian, so HIA’s custodian duties do not bind you directly. We work this exact situation through end to end, from intake to email, in the Ontario therapist with an Alberta client scenario.

The duty that does follow you across the border comes from college guidance: the requirement to confirm whether you may register or practise in the client’s province, which we cover below. HIA s.64 PIA submission is an Alberta custodian obligation, not one that attaches to an out of province therapist.

If you’re going to maintain Alberta clients on a Gmail based workflow, a written privacy impact assessment is still worth preparing as a risk management step, even though s.64 does not compel you to file one.

Ontario therapist, BC client

BC PIPA applies on the client side. BC has no statutory lock box equivalent and no mandated audit trail.

PHIPA is the stricter standard for both. BC PIPA has no data residency rule. Its s.34 security arrangements apply wherever the information is held.

Alberta therapist, Ontario client

PHIPA s.12(2) is the lower of the two, because it sets no harm test: the duty attaches where personal health information is stolen, lost, or used or disclosed without authority. An incident that wouldn’t meet Alberta PIPA’s real risk of significant harm test (s.34.1) can still trigger PHIPA notice to the affected individual, and reporting to the IPC in the circumstances prescribed by O. Reg. 329/04 s.6.3.

If you’re an Alberta therapist with Ontario clients, build your breach response around the PHIPA threshold.

Client relocates between provinces

This is the one most therapists miss, and it is usually stated backwards. A client who started in Vancouver and relocated to Toronto does not turn your file into a PHIPA matter. PHIPA’s duties attach to Ontario health information custodians, so if you practise in BC, BC PIPA keeps governing you. What changes is practical rather than statutory: consent, records, and the local expectations your client now lives under are all worth revisiting.

Consent documentation should be re-confirmed and any consent directives originally captured under BC PIPA should be re-validated against PHIPA’s lock box framework. The audit trail should reflect the change, and the consent date should be the date of the re-confirmation, not the original onboarding date.

For the full provincial comparison underpinning these scenarios, see the PHIPA vs HIA vs BC PIPA guide.

The “highest standard” approach

You can’t decide jurisdiction once and walk away. You can, however, build your email and consent practice to the strictest of the standards across the three provinces and stop asking the question.

Stacking the requirements

Here’s what “highest standard” looks like when you stack the requirements:

Stacking the requirements
Operational element	PHIPA (Ontario)	PIPA (Alberta) + CAP	BC PIPA	Highest standard
Encryption at rest and in transit	Safeguards duty; CRPO Standard 5.6 names encryption among electronic safeguards	Safeguards duty (Alberta PIPA + CAP standards)	Safeguards duty (BC PIPA s.34, “reasonable security arrangements”)	None of the three statutes mentions encryption, though privacy commissioners’ guidance asks for it in some cases. Treat it as the practical way to meet the safeguards duty in all three provinces.
Consent format	Written or oral, ongoing (CRPO Standard 3.4)	Written or oral, ongoing (CAP guideline)	Written or oral, ongoing (BCACC standards)	Express, documented, ongoing.
Lock box / consent directive	Supported (PHIPA ss.37(1)(a), 38(1)(a), 50(1)(e))	Not supported	Not supported	Honour a lock box on request even if the client’s province doesn’t mandate it.
Audit trail	Not prescribed; audit capability sits in CRPO Standard 5.6 commentary as an example. Clinical records are kept at least 10 years from the last session, or 10 years from the client’s 18th birthday, whichever is later, under Standard 5.1	Record keeping expected (Alberta PIPA + CAP standards); immutability not specified	Not statutorily required	Keep an access log and retain clinical records for the longest period that applies to you (see Retention).
Breach threshold	PHI stolen, lost, or used or disclosed without authority (PHIPA s.12(2))	Real risk of significant harm; notify the Commissioner without unreasonable delay (Alberta PIPA s.34.1), individuals when the Commissioner requires it (s.37.1). The HIA s.60.1 “risk of harm” test binds custodians, not private practice therapists	No statutory breach duty for private organizations; OIPC BC recommends notice on real risk of significant harm	Notify on the PHIPA trigger, the broadest of the three: personal health information stolen, lost, or used or disclosed without authority (s.12(2)).
PIA	Not mandated for the therapist	HIA s.64 binds Alberta custodians, not an out of province therapist; prudent as risk management	Not mandated	Maintain a written PIA as a risk management step.
Retention	At least 10 years from the last session, or 10 years from the client’s 18th birthday, whichever is later (CRPO Standard 5.1)	10 year minimum (CAP Standards)	No statutory period. CHCPBC licensees: at least 16 years (standard 6.1)	The longest period that applies to you: 16 years for a CHCPBC licensee; otherwise 10 years from the last session or from the client’s 18th birthday, whichever is later.
AI processing on PHI	Statute silent on AI; consent rules apply to any disclosure	Statute silent on AI; CAP Use of Technology guideline says avoid giving patient data to AI tools	Statute silent on AI; consent rules apply to any disclosure	Treat AI processing as a disclosure needing consent; follow CAP guidance and keep patient data out of AI tools that lack safeguards.
Data residency	Not mandated; transfer allowed with express consent	Not mandated; Canadian hosting recommended	Not mandated; s.34 security arrangements apply wherever it’s stored	Prefer Canadian hosted infrastructure for compliance data.

Why this clears the bar

Build your operations to that right hand column and you’re working to the strictest of the three frameworks. Two practical consequences follow from that choice.

First, you stop making jurisdiction calls for individual emails. A new client books from Halifax tomorrow, and your encryption, consent, audit trail, and PIA are already at the highest standard.

You add the client to your audit trail, confirm consent, and continue. The decision tree shrinks to two steps where it used to be five.

What this looks like in a regulator review

Second, you build defensibly. If a regulator does come asking, your file shows you applied the strictest applicable rule rather than the most convenient one.

Discovery during a college complaint or civil litigation looks different when the documentation shows you over indexed on safeguards.

Bottom line

The highest standard approach is: encrypt every email containing PHI, capture express written consent that supports a lock box on request, maintain an immutable audit trail with 10 year retention, write a PIA as risk management (HIA s.64 itself binds Alberta custodians, not an out of province therapist), and use Canadian hosted compliance infrastructure for audit trail and any portal messages. Keep patient data out of AI tools that lack safeguards, and treat any AI processing as a disclosure needing consent. Honour the lowest breach threshold of the three provinces.

College registration across provincial lines

Privacy law and college regulation are separate analyses. They share the word “compliance,” but they answer different questions.

Privacy law asks what the therapist must do with PHI. College regulation asks whether the therapist is permitted to practise in a given province in the first place. Conflating them is a common error.

Colleges by province

The colleges relevant to psychotherapy are different in each province:

Ontario. CRPO (College of Registered Psychotherapists of Ontario) regulates Registered Psychotherapists. CPBAO (College of Psychologists and Behaviour Analysts of Ontario) regulates psychologists and behaviour analysts. OCSWSSW regulates social workers. CPSO regulates physicians, including psychiatrists, but not psychotherapists.
Alberta. CAP (College of Alberta Psychologists) regulates psychologists. Counselling therapists in Alberta remain unregulated; ACTA membership is voluntary, the standalone CCTA path was abandoned, and the province announced in March 2024 that CAP will take on counselling therapist regulation, still pending. ACSW regulates social workers. CPSA regulates physicians.
British Columbia. BCACC (BC Association of Clinical Counsellors) covers counselling therapists today. CHCPBC (College of Health and Care Professionals of BC) takes over psychotherapy regulation under the HPOA effective November 29, 2027. Until then, psychotherapy is not a regulated health profession in BC in the same sense as Ontario or Alberta.

Registering where you practise

If you practise across provinces, you may need to register with the relevant college in each province where you provide services. The colleges have their own rules about virtual practice, supervised practice, and reciprocal recognition.

Cross-college recognition isn’t a settled framework, and we won’t invent rules that the colleges haven’t published. See our cross college comparison guide for a side by side of CRPO, CAP, and the CHCPBC transition.

Check directly with each college before accepting clients in a new province.

Two questions, two answers

The general principle: if you’re sending email containing PHI to a client in another province, the privacy law of that province may also apply alongside your own, so get advice. If you treat a resident of another province, check whether that province requires you to be licensed there (CRPO Standard 3.4.5). A college’s standards bind you once you’re registered with it.

Both questions need answers. Neither answers the other.

Practical steps for cross provincial compliance

Here’s the workflow.

Step 1. Identify which provinces your clients are located in

Pull your client list. Add a column for province of residence. If you see clients across three provinces, you’re managing three regulatory regimes whether you’ve documented it or not. Update this list when a client moves.

Step 2. Review the privacy law requirements for each province

For each province represented in your client list, confirm the operational requirements. Encryption, consent format, lock box, audit trail, breach threshold, PIA, retention.

The PHIPA vs HIA vs BC PIPA guide covers the full comparison. For depth in a single province, see the PHIPA email requirements, the Alberta HIA and therapist email: who it covers, or the BC PIPA email privacy obligations post for your specific case.

For the broader cross provincial overview, see email privacy laws across Canada. If your practice runs on Google Workspace, Google Workspace data regions covers how to set data location for Gmail and Drive content.

Step 3. Apply the highest standard approach

Use the comparison table in this post. For each operational element, identify the strictest of the applicable requirements and build to that.

Document the decision. The documentation matters as much as the practice when a regulator asks why you handled a file the way you did.

A single consent form covering all three provincial regimes is cleaner than three separate forms.

The addendum should name the therapist’s province, the client’s province, and the applicable laws; capture express written consent for electronic communication with PHI; describe the lock box option and how to invoke it; and describe the breach notification commitment using the strictest threshold.

The cross provincial compliance quick start lays out the addendum elements and adapts them to PHIPA, HIA, and BC PIPA.

Step 5. Review college registration requirements for each province you practise in

Distinct from privacy law. Check CRPO, CAP, BCACC/CHCPBC, OCSWSSW, ACSW, BCCSW, or the relevant professional body for your designation.

Some colleges require formal registration to provide services into the province; some recognize practice across provinces under specific conditions. Verify directly before booking a client in a new province.

Step 6. Document your cross provincial compliance approach in your email policy

Put the highest standard decision in writing. The email policy template gives you the structure: scope (which provinces, which clients, which client types), operational rules (encryption, consent, lock box, audit trail, retention, PIA), breach response, and review cadence.

Treat this as a working document. Update it when a client relocates or your practice expands into a new province.

A PIA is worth preparing at this step for any therapist with Alberta clients, as risk management. HIA s.64 imposes the submission duty on Alberta custodians, not on an out of province therapist, so this is prudence rather than a statutory obligation that binds you.

Our privacy impact assessment template gives you a starting structure informed by the OIPC Alberta approach.

FAQ

Which privacy law applies if my client is in another province?

Your own province’s law always applies, and your client’s province’s law may also apply. Your province treats you as a custodian or organization; whether your client’s province’s privacy law reaches you is unsettled, so get advice. No Canadian court has resolved the overlap squarely for private practice therapists. The defensible approach is to apply the stricter of the applicable requirements rather than re-decide jurisdiction per email.

Do I need to register with the college in my client’s province?

Possibly. College registration is separate from privacy law and follows each college’s rules. CRPO regulates psychotherapy in Ontario, CAP regulates psychology in Alberta, BCACC currently covers counselling in BC, and CHCPBC takes over psychotherapy regulation in BC on November 29, 2027. Check directly with each college before providing services into a new province.

Can I use the same email setup for all provinces?

Yes, provided the setup meets the highest applicable standard across all your client provinces. None of these laws names encryption; each imposes a safeguards duty, and encryption is the practical way to meet it for health information sent by email. Keeping an access log you don’t rewrite after the fact, plus keeping clinical records at least 10 years from the last session or from the client’s 18th birthday, whichever is later, covers Ontario: CRPO Standard 5.1 sets that retention period, and Standard 5.6 treats audit capability as an example of protecting records rather than a prescribed rule. Express written consent, lock box on request, and a written PIA cover the strictest of the other three operational elements.

What if PIPEDA applies instead of a provincial law?

PIPEDA applies to commercial activity, and provinces with private sector or health sector laws the Governor in Council has designated substantially similar are largely carved out of its reach for activity within the province. Ontario’s PHIPA, Alberta’s PIPA, and BC’s PIPA all carry that designation, so provincial law governs PHI handled by therapists in private practice in these provinces. Designation does not switch off PIPEDA for personal information that moves across a border in a commercial transfer, so building to the provincial highest standard, with security and accountability over any cross border handling, is the safer footing.

Where Curio fits

You don’t need a product to apply the highest standard. The consent template, the audit trail discipline, and the PIA are doable independently. What’s harder to do by hand is keep encryption automatic on every email and maintain an immutable audit trail that holds up in a college complaint or an OIPC review.

Curio’s compliance infrastructure handles encryption and audit trail for Canadian health privacy law across PHIPA, Alberta PIPA and BC PIPA. One setup covers your clients in Ontario, Alberta and BC. Curio is available in every province and territory except Quebec. Start now.

Consent documentation stays with you, and so does any privacy impact assessment you write. Only an Alberta HIA custodian has to submit one to the OIPC (HIA s.64(1)). Curio does not write either. Curio handles encryption and a send log for the email you send clients. Your other safeguards (your Google account, your devices, the mail clients send you) and the consent layer stay with you.

Regulatory content disclaimer. This content is for informational purposes only and does not constitute legal advice. Privacy regulations vary by province and are subject to change. Verify current requirements with your provincial regulatory body. Product disclaimer. Curio is designed to encrypt outbound email and maintain a Canadian audit trail. It is not a substitute for professional legal or compliance advice. Consult a qualified privacy professional for your specific situation.

Cross provincial telehealth privacy for therapists

Which law applies to cross provincial email?