Which privacy law applies to your practice?
- Your own province’s privacy law always governs you. Whether your client’s province law also reaches you is unsettled.
- Ontario private practice therapists are health information custodians under PHIPA.
- Alberta private practice therapists fall under Alberta PIPA, not the HIA.
- BC private practice therapists fall under BC PIPA.
- PIPEDA is the baseline and still reaches transfers across provincial and national borders.
- Breach notification works four different ways across these four regimes.
- Of these four, Ontario alone has circle of care implied consent and a lock box.
Which privacy law applies to a therapist in Canada starts with where your practice carries on its activity: your own province’s law always governs you. In Ontario it’s the Personal Health Information Protection Act (PHIPA). In Alberta and British Columbia it’s each province’s Personal Information Protection Act (PIPA). The Personal Information Protection and Electronic Documents Act (PIPEDA) sits underneath all of them as the federal baseline. When a client lives in another province, that province’s law may also apply, and how far it reaches is unsettled.
Key takeaways
- A provincial law declared substantially similar to PIPEDA displaces it for commercial activity carried on inside that province. PIPEDA remains the baseline and continues to reach interprovincial and international transfers.
- Ontario’s designation instrument is health custodian specific. Alberta’s and BC’s are general private sector designations. That difference shapes everything downstream.
- Alberta private practice therapists are not custodians under the Health Information Act. Psychologists, counselling therapists and social workers are absent from the custodian list at Health Information (Ministerial) Regulation (AR 106/2026) s.1.
- Breach notification differs four ways: mandatory in Ontario where personal health information is stolen, lost, or used or disclosed without authority, mandatory in Alberta on a real risk of significant harm, voluntary in BC, and mandatory federally.
- Penalty ceilings differ by an order of magnitude. Ontario reaches $200,000 and $1,000,000 under PHIPA s.72(2). Alberta PIPA s.59(2) reaches $10,000 and $100,000.
- No privacy statute in this guide requires encryption by name, though privacy commissioners’ guidance asks for it in some cases. Each statute imposes a safeguards duty instead, and the wordings are not interchangeable.
A therapist in Calgary worries about PHIPA. It doesn’t govern her. A therapist in Ottawa keeps seeing a client who moved to Vancouver, and assumes BC law followed the client across the border. A therapist anywhere in the country reads an American blog post about HIPAA and absorbs a framework that has no purchase on her practice at all.
All three are answering a question they haven’t asked precisely enough.
The question isn’t “what is the law.” It’s “which law reaches me, and what does it want.” Those have different answers depending on one fact about you and one fact about your practice, and almost nothing else.
Here’s the decision path, then four self contained answers, then the places where the regimes genuinely diverge.
Which law applies to you, and what decides it?
Your statute is decided by the province where your practice carries on its commercial activity. If that province has a privacy law declared substantially similar to PIPEDA, the provincial law displaces PIPEDA for activity inside the province. If it doesn’t, PIPEDA applies directly.
That single mechanism explains most of the confusion in this category. People assume the question is complicated. It’s two facts.
| If you practise in | Your statute | Your status under it | Designation |
|---|---|---|---|
| Ontario | PHIPA | Health information custodian | SOR/2005-399, health custodian specific |
| Alberta | Alberta PIPA | Organization | Substantially similar, general private sector |
| British Columbia | BC PIPA | Organization | Substantially similar, general private sector |
| Anywhere, for cross border transfers | PIPEDA | Organization | The baseline itself |
What substantial similarity actually does
Substantial similarity isn’t a compliment paid to a province. It’s an operative mechanism: the federal government declares a provincial law substantially similar, and organizations in that province are exempted from PIPEDA for commercial activity carried on within the province.
The exemption is bounded by that phrase. Inside the province, provincial law. Crossing out of it, PIPEDA is still there.
The Office of the Privacy Commissioner of Canada maintains the summary of which laws sit where.
Ontario’s designation is the narrow one
Here’s a detail worth pinning down. Ontario’s instrument is called the Health Information Custodians in the Province of Ontario Exemption Order. It’s about custodians specifically.
Alberta and BC took a different route. Their PIPAs were designated as substantially similar for the general private sector, which is why an Alberta therapist is an “organization” rather than a custodian of anything.
That’s not a technicality. It’s why the Ontario regime has mechanisms the other two don’t have at all, which we get to further down.
Does your client’s province change which law applies to you?
It doesn’t take away your own. Your province’s privacy law always governs you, so an Ontario therapist seeing a client who has moved to Alberta is still a health information custodian under PHIPA.
Whether the client’s province law also applies to you is a separate question, and how far it reaches is unsettled. If you practise into another province, get advice for that province before you rely on either answer.
What the client’s location does change is the transfer. Sending personal information from your practice in one province to a recipient in another is exactly the interprovincial activity PIPEDA still reaches, even where a provincial law has displaced it for local activity.
So the answer isn’t “nothing changes.” Your own statute stays, PIPEDA reaches the transfer, and the client’s province may add a layer of its own.
Professional regulation usually treats practice as happening where the client is, so the client’s province can require you to register there. Practising into more than one province adds a set of questions about consent, records and supervision that sit outside this guide. The cross provincial telehealth privacy guide works through those.
What applies if you practise in Ontario?
In Ontario, private practice therapists are health information custodians under PHIPA. Your safeguards duty is at PHIPA s.12(1): take steps that are reasonable in the circumstances to protect personal health information. Ontario also carries two mechanisms no other province in this guide has, and the highest penalty ceilings.
Custodian status is the thing to sit with. It’s a defined role with named duties attached, rather than a general obligation that happens to include you.
It’s also why Ontario content is so over represented online. PHIPA generates more writing than Alberta PIPA and BC PIPA combined, which is great if you practise in Toronto and actively misleading if you don’t.
What the safeguards duty asks of email
Nothing in PHIPA names encryption. The duty is reasonableness, measured against the circumstances, and email is one of those circumstances.
We go through the mechanics of that in what PHIPA asks of Ontario therapist email, including the consent points this guide deliberately stays out of.
The college layer sits on top
The College of Registered Psychotherapists of Ontario (CRPO) sets practice standards above the statute, and they move more often than PHIPA does.
CRPO Standard 5.6 on record storage, security and retrieval does name encryption. It names it among safeguards, and gives encrypted electronic transmission as an example inside a reasonable efforts duty. It doesn’t say “requires,” and neither should anyone quoting it to you.
Where Ontario oversight lands
The Information and Privacy Commissioner of Ontario (IPC) oversees PHIPA. It has had administrative monetary penalty powers under PHIPA s.61(1)(h.1) and s.61.1 since January 1, 2024, with the maximums set by O. Reg. 329/04 s.35(1): $50,000 for a natural person, $500,000 otherwise.
Most therapists meet the IPC through a complaint rather than an investigation. The question in either case is the same one: what safeguards were running, and can you show it.
What applies if you practise in Alberta?
If you’re in private practice in Alberta, your statute is Alberta PIPA, not the Health Information Act. Psychologists, counselling therapists and social workers are not on the custodian list at Health Information (Ministerial) Regulation (AR 106/2026) s.1, so the HIA doesn’t reach you. You’re an “organization” under PIPA, with your college’s standards of practice on top.
This is the row that most often goes wrong. It’s worth being blunt about why.
People reach for the HIA because it has “health” in the name. Reasonable instinct, wrong statute. Custodian status under the HIA comes from a designation list, this population isn’t on it, and so the Act reaches a therapist only as an affiliate inside a custodian organization or through an information manager agreement.
What PIPA does and doesn’t distinguish
Alberta PIPA defines personal information at s.1(1)(k). No health specific category. No sensitivity tiers.
Client notes and a mailing list are the same class of thing in the Act’s own terms, which lands oddly on anyone expecting a health statute to be doing the work here.
Your safeguards duty sits at Alberta PIPA s.34: reasonable security arrangements against the risks the section names. The word “encrypt” appears nowhere in the Act.
That absence is not permission. It’s the same reasonableness structure Ontario uses, in different words.
Your college does the specifying
The College of Alberta Psychologists (CAP) sets standards of practice for psychologists, and the Alberta College of Social Workers (ACSW) does the same for social workers. Those are where technology expectations get concrete, not the statute.
The Alberta email encryption guide works through PIPA and the CAP standards together, which is the pairing that actually governs an Alberta private practice.
Who oversees you
The Office of the Information and Privacy Commissioner of Alberta administers PIPA. Alberta’s breach duty runs to the Commissioner first, which is a real structural difference from Ontario and we come back to it below.
What applies if you practise in British Columbia?
In British Columbia, private practice therapists fall under BC PIPA as organizations. The safeguards duty is at BC PIPA s.34: reasonable security arrangements against the risks the section names. BC PIPA sets no breach notification duty for private sector organizations, which makes BC the outlier of the four regimes in this guide.
BC and Alberta both get described inaccurately, and the errors run in opposite directions. Alberta gets over regulated in writing. BC gets a public sector statute, FIPPA, imported onto private practice, which is a different Act with a different scope.
The FIPPA confusion, cleared up
BC does have a mandatory breach notification regime. It lives in FIPPA s.36.3, which binds public bodies, not private practices.
A private practice is not a public body. If someone tells you BC private sector breach notification is mandatory, they’ve read the wrong statute.
What the Office of the Information and Privacy Commissioner for BC recommends is notification where there’s a real risk of significant harm. A recommendation is worth following. It isn’t a duty, and the difference matters when you’re writing a policy.
The safeguards duty holds regardless
None of that softens s.34. The security arrangements obligation applies whether or not a notification duty ever attaches, and it applies continuously rather than at the moment something goes wrong.
For how that plays out on client email specifically, the BC email encryption guide goes further.
One dated change on the horizon
On November 29, 2027, the College of Health and Care Professionals of British Columbia (CHCPBC) begins regulating psychotherapy. A date already fixed, not a prediction. It adds a college standards layer BC private practice hasn’t had.
When does PIPEDA apply to you?
PIPEDA applies directly where no provincial law has been declared substantially similar. In Ontario, Alberta and BC it’s displaced for commercial activity carried on inside the province, but it continues to reach interprovincial and international transfers of personal information. It is the floor, not an alternative.
Therapists tend to meet PIPEDA in one of two ways. Either it’s their governing statute outright, or it shows up the first time information crosses a border.
The wording that only belongs to PIPEDA
PIPEDA Principle 7 requires safeguards appropriate to the sensitivity of the information. That formulation is genuinely PIPEDA’s, and it is the one that turns up attributed to statutes that don’t contain it.
PHIPA doesn’t use it. Neither “sensitive” nor “sensitivity” appears anywhere in the Act, verified against the e-Laws consolidation on September 21, 2026. Alberta PIPA and BC PIPA don’t carry that formulation either, though both do use the word: Alberta PIPA s.8(3)(c) weighs “the level of the sensitivity, if any, of the information in the circumstances” in its opt out notice test, and BC PIPA s.8(3)(d) runs the parallel test “having regard to the sensitivity of the personal information in the circumstances”.
Four statutes, four wordings. Merging them produces a false statement rather than a shorter one.
What federal oversight looks like
The Office of the Privacy Commissioner of Canada investigates and reports. It has no order making power.
We carry no PIPEDA penalty ceiling in this guide, because we haven’t verified one to the standard the rest of this table is held to. An unverified number is worse than an absent one.
Where do the four regimes actually differ?
The differences that matter aren’t the ones the marketing copy points at. So where are they? Three places, and each one changes what you’d actually do on a Tuesday afternoon.
How does breach notification differ by province?
| Where you practise | Notification required? | Threshold | Timing | Basis |
|---|---|---|---|---|
| Ontario | Yes, to the individual | PHI stolen, lost, or used or disclosed without authority | At the first reasonable opportunity | PHIPA s.12(2) |
| Alberta | Yes, to the Commissioner | Real risk of significant harm | Without unreasonable delay | Alberta PIPA s.34.1 |
| British Columbia | No, voluntary | OIPC recommends on a real risk of significant harm | Not applicable | BC PIPA s.34 is safeguards only; the mandatory regime is FIPPA s.36.3, public bodies |
| Federal | Yes | Real risk of significant harm | As soon as feasible | PIPEDA s.10.1; SOR/2018-64 |
Four regimes, four answers, and the thresholds aren’t close to each other. Ontario’s trigger is personal health information stolen, lost, or used or disclosed without authority. Alberta’s and the federal one require a real risk of significant harm before anything attaches. BC’s private sector duty doesn’t exist.
Two things the table can’t hold:
Alberta’s sequence runs through the Commissioner. You notify the Commissioner where a real risk of significant harm exists, without unreasonable delay, under s.34.1. Notification to affected individuals follows when the Commissioner requires it, under s.37.1. It isn’t automatic.
Ontario’s individual notice and IPC reporting are different triggers. PHIPA s.12(2) carries the duty to notify the individual. Certain prescribed circumstances also trigger a report to the IPC, and that’s a narrower set. Anyone telling you to report every breach to the IPC has collapsed two duties into one.
On records: federally, breach records are kept for 24 months (SOR/2018-64 s.6(1)). Ontario sets no retention period for breach records; what it requires is an annual report to the IPC of the number of incidents, by March 1 each year (O. Reg. 329/04 s.6.4). Alberta and BC expect records too, with no period we can verify.
How far apart are the penalty ceilings?
| Regime | Individual maximum | Organization maximum | Basis |
|---|---|---|---|
| Ontario, offence | $200,000 | $1,000,000 | PHIPA s.72(2); the natural-person maximum also carries imprisonment of up to 1 year, in the alternative or in addition. The corporate maximum is a fine only |
| Ontario, administrative monetary penalty | $50,000 | $500,000 | O. Reg. 329/04 s.35(1), maximums in force since January 1, 2024 |
| Alberta | $10,000 | $100,000 | Alberta PIPA s.59(2) |
| British Columbia | $10,000 | $100,000 | BC PIPA s.56(2), offence fines on conviction |
| Federal | Not carried here | Not carried here | The OPC has no order making power |
An order of magnitude separates Ontario from the two PIPA provinces. Ten times at the organization ceiling, twenty at the individual one.
Ontario’s two rows are two different routes, not a rounding of one. The s.72(2) figures are prosecution maximums. The O. Reg. 329/04 s.35(1) figures are administrative monetary penalties, which the IPC has been able to impose directly since January 1, 2024.
A lower ceiling doesn’t mean a lighter duty. Alberta’s and BC’s safeguards obligations are unchanged by the number at the bottom of the Act, and the Alberta and BC Commissioners both have real powers. It means the province you practise in changes the size of the worst case, not the shape of the obligation.
One warning specific to Alberta. You may see six and seven figure maximums attached to Alberta. Those are HIA penalties, and the HIA doesn’t govern private practice therapists. For this population the section is Alberta PIPA s.59(2), and the numbers are $10,000 and $100,000.
What does Ontario have that Alberta and BC don’t?
| Mechanism | Ontario | Alberta | British Columbia |
|---|---|---|---|
| Implied consent inside the circle of care | Yes, PHIPA s.20(2) | No | No |
| Lock box, a client instruction to withhold a record | Yes, PHIPA s.37(1)(a) (use) and s.38(1)(a) (disclosure to other custodians) | No | No |
This is the sharpest line in the whole comparison, and it traces straight back to that narrow Ontario designation.
Circle of care means an Ontario custodian can rely on implied consent to share personal health information with other custodians providing care to the same client. You don’t collect a fresh consent for every referral note.
The lock box is the other side of it. An Ontario client can instruct a custodian to withhold a specific record from other providers under PHIPA s.38(1)(a), and the custodian has to honour that instruction.
Neither construct exists in Alberta PIPA or BC PIPA. Alberta and BC therapists work under a general consent regime instead, with no circle to imply consent inside and no statutory instruction to withhold against.
If you practise in more than one of these provinces, that asymmetry is the one that will bite. A referral workflow built around Ontario’s circle of care doesn’t port.
Does any of this require you to encrypt email?
No privacy statute in this guide requires encryption by name. Each imposes a safeguards duty in its own wording, and the regulators read more into that duty in some cases: Ontario’s Information and Privacy Commissioner, for one, says you should encrypt email with clients where you can. Encryption is how the duty is met in practice for email. The formulations are not interchangeable.
Here’s the table people should be shown instead of a vendor claim.
| Source | The actual formulation |
|---|---|
| PHIPA s.12(1) | Steps that are reasonable in the circumstances |
| Alberta PIPA s.34 | Reasonable security arrangements against the named risks |
| BC PIPA s.34 | Reasonable security arrangements against the named risks |
| PIPEDA Principle 7 | Safeguards appropriate to the sensitivity of the information |
Read them again. Of the four provisions, only the last mentions sensitivity, and it’s the one that gets quoted as though it were all of them.
A vendor who tells you the statute names encryption is overstating the law.
None of which makes encryption optional in practice. Client mental health information is about as sensitive as personal information gets, and in our reading, plain text across the open internet is hard to defend as a reasonable step under any of the four wordings.
Where a product fits, and where it doesn’t
Curio secures every client email, holds it to Canadian mental health privacy law and keeps the record that it did. Every message is encrypted automatically, every send is logged in a Canadian audit trail running in GCP northamerica-northeast1 in Montreal, and a withdrawn consent directive is denied rather than downgraded.
What it doesn’t do is calculate your breach notification deadline. You’ve just read why: not one of these four regimes sets a countable clock. First reasonable opportunity, without unreasonable delay, as soon as feasible. Those are reasonableness standards, and a product that displays a countdown against them is inventing certainty that the statutes don’t offer.
The duty stays with you either way. Curio’s job is to make the safeguard provable when someone asks. It’s $15/mo CAD per therapist, it works with the Gmail you already use, and there’s no second inbox.
Curio is not a substitute for professional legal or compliance advice. Consult a qualified privacy professional for your specific situation.
What this guide doesn’t settle
Four regimes. That’s the honest scope, and it’s worth naming what falls outside it.
Other provinces. Saskatchewan, Manitoba, Nova Scotia and the rest each have their own arrangement of statute and college standard. We haven’t verified those to the standard the four above are held to, so they don’t get a row. A guessed row reads exactly like a verified one, which is the problem with guessing.
Quebec. Out of scope here, and Curio signups aren’t open in Quebec while Law 25 work is outstanding.
Consent mechanics. Knowing which statute governs you is upstream of knowing what consent it wants. Ontario’s consent provisions in particular are more involved than a comparison table can carry, and we’d rather point you at the Ontario email guide than compress them.
College standards. Every one of these statutes has a college layer above it, and those get revised more often than the Acts do. Read your own college’s current standard rather than any summary, this one included.
The breach sections specifically. The consent and breach provisions in the underlying rule set have not been read at primary source for all four of these jurisdictions. The breach and penalty tables in this guide were checked against the statutes on September 21, 2026, which is why some cells carry a pinpoint and others carry only an Act name. Where we couldn’t verify a section number, we left it out rather than filling it in.
For a shorter pass over the same ground, the cross provincial email privacy overview covers Ontario, Alberta and BC side by side.
Frequently asked questions
Which privacy law applies to a therapist in Canada?
Your own province’s law always governs you. Ontario therapists are health information custodians under PHIPA. Alberta and BC private practice therapists are organizations under their province’s PIPA. PIPEDA is the federal baseline and still reaches transfers that cross provincial or national borders. If your client is in another province, that province’s law may also apply, and its reach is unsettled.
Is it PIPEDA or my provincial privacy law that governs me?
Both, in different places. A provincial law declared substantially similar to PIPEDA displaces it for commercial activity carried on inside that province, which covers most of what a local practice does. PIPEDA continues to apply to interprovincial and international transfers of personal information regardless.
My client moved to another province. Does my governing law change?
Your own law doesn’t change: an Ontario custodian stays an Ontario custodian when a client relocates to Alberta. Two things may be added. The information now crosses a provincial border, which brings PIPEDA’s transfer provisions into the picture, and Alberta’s law may also apply. How far it reaches is unsettled, so get advice for that province.
Do I have to report every privacy breach?
It depends entirely on where you practise. Ontario’s trigger is personal health information stolen, lost, or used or disclosed without authority, with notice to the individual under PHIPA s.12(2). Alberta requires notice to the Commissioner on a real risk of significant harm. BC sets no private sector duty at all. The federal threshold matches Alberta’s.
Are Alberta therapists covered by the Health Information Act?
Not in private practice. Psychologists, counselling therapists and social workers are absent from the custodian list at Health Information (Ministerial) Regulation (AR 106/2026) s.1. Alberta PIPA governs instead, with college standards on top. The HIA reaches a therapist only as an affiliate of a custodian or under an information manager agreement.
Which province has the highest privacy penalties for therapists?
Ontario, by an order of magnitude. PHIPA s.72(2) reaches $200,000 for an individual, who may also face imprisonment of up to 1 year, and $1,000,000 for an organization, which faces a fine only. Alberta PIPA s.59(2) and BC PIPA s.56(2) both cap at $10,000 and $100,000. The safeguards duty is comparable regardless of the ceiling.
This content is for informational purposes only and does not constitute legal advice. Privacy regulations vary by province and are subject to change. Verify current requirements with your provincial regulatory body.
Every statutory citation above was checked on September 21, 2026. Where a section number could not be verified at the primary source, the claim is stated at Act level or omitted.
Now available
Your Gmail. Secure for Canadian mental health privacy law.
