If you practise in one province and see clients who live, travel, or relocate to another, your intake consent form usually only covers one privacy law. PHIPA, HIA, and BC PIPA each set their own consent rules, and a single province template can leave gaps when a client crosses a provincial line mid care.
This addendum is built to append to a consent form you already use, such as the PHIPA + CRPO consent form template (T-1) or any provincial equivalent. It does not replace your base form. It documents that the client understands which law applies, what changes if their province of residence changes, and how you handle obligations under more than one law at the same time.
The addendum below is written for therapists holding personal health information under more than one provincial regime. If your practice is single province and your clients never move or travel, you probably don’t need it.
When to use this addendum
Attach this addendum to your base consent form when any of the following are true:
- You practise in Ontario, Alberta, or BC, and a client primarily resides in a different Canadian province
- You offer telehealth across provincial lines (common for relocations, students, snowbird clients)
- A client’s province of residence may change during the course of care
- You hold registration in more than one provincial college
If none of these apply, your base consent form is enough.
Addendum: cross provincial privacy and consent
[Append to your existing consent form. Section letters continue from your base form; rename as needed.]
I. Province of practice and province of client
[PHIPA s.18 / HIA s.34 (written or electronic consent) / BC PIPA ss.6-9: consent must be knowledgeable; client identifies applicable jurisdiction]
Province where I (the therapist) am registered and practising: [___]
Provincial college I am registered with: [___] (Example: CRPO in Ontario, CAP in Alberta, CHCPBC in BC for psychotherapy from Nov 29, 2027)
Province where you (the client) primarily reside: [___]
If different from your province of residence, where will you be physically located during most sessions? [___]
J. Which privacy laws apply to your care
[PHIPA s.18 / HIA s.34 (written or electronic consent) / BC PIPA ss.6-9: knowledgeable consent regarding applicable law]
Your personal health information may be subject to more than one privacy law at the same time. The law that applies depends on where I practise, where you receive care, and how your information moves between us.
The laws that may apply to our work together:
- Personal Health Information Protection Act (PHIPA), Ontario: applies if I practise in Ontario as a health information custodian
- Health Information Act (HIA), Alberta: applies if I practise in Alberta as an HIA custodian. Most private practice therapists are not on the HIA custodian designation list; in that case Alberta PIPA applies instead, and the HIA reaches me only as an affiliate working inside a custodian organization
- Personal Information Protection Act (PIPA), British Columbia: applies if I practise in BC as a private sector organization
- Personal Information Protection and Electronic Documents Act (PIPEDA), federal — may apply when personal information crosses a provincial border in the course of commercial activity
Where more than one law applies, I will follow the higher standard at each decision point (encryption, consent specificity, breach notification, audit trail, retention).
K. What changes if you relocate between provinces
[PHIPA s.18 / HIA s.34 (written or electronic consent) / BC PIPA s.10(1): notification of material changes; consent must remain knowledgeable]
If your province of residence changes during the course of care, the following may need to change:
- The privacy law that primarily governs your record. If you move from Ontario to Alberta, your PHI may become subject to HIA. We will discuss this at our next session after you notify me.
- Your consent document. I may ask you to re sign this addendum with the new province noted, or sign a fresh consent form aligned with the new applicable law.
- The college complaint pathway. Complaints about my conduct continue to go to my college (CRPO, CAP, or CHCPBC). Complaints about privacy go to the privacy commissioner in the province whose law applies.
- Your right to access your record. Access rights are set by the law that applies to the custodian holding the record. Moving provinces does not extinguish your access rights to records I already hold.
Please notify me in writing within [___] business days of any change to your primary province of residence.
L. Consent under more than one law
[PHIPA s.18: express consent for electronic communication is IPC guidance, not s.18 itself / HIA s.34: written or electronic consent / BC PIPA ss.6-9: consent required (deemed consent under s.8 is limited and does not extend to sensitive personal information)]
Consent rules differ across the three provincial regimes. Where more than one applies, I will treat the strictest as the minimum:
| Decision point | What I will do |
|---|---|
| Collecting your PHI | Obtain express written consent at intake under the highest applicable standard |
| Using email or text with you | Obtain express written consent for each electronic channel, named individually |
| Disclosing your PHI to a third party (insurer, referral, family) | Obtain express written consent for each disclosure unless a legal exception applies |
| Withdrawing consent | Honour your withdrawal within the timeline set by the strictest applicable law |
| Recording sessions or storing notes | Apply the encryption, retention, and audit standard required by the strictest applicable law |
If you want to consent to communication or disclosure under one province’s rules but not another’s, tell me. I will document the scope of your consent and apply it.
M. My obligations under more than one provincial law
[PHIPA s.12(1) / HIA s.60 / BC PIPA s.34: reasonable security arrangements; transparency to client]
Where I am subject to more than one provincial regime in your care, I will:
- Apply the strictest applicable safeguard for email, file storage, and audit logging
- Maintain documentation that meets the privacy impact assessment requirement of the strictest applicable law (in Alberta, HIA s.64 requires a custodian to prepare a PIA and submit it to the OIPC Alberta before implementing a new health information system; this duty binds HIA custodians, and most private practice therapists are not custodians, in which case Alberta PIPA applies and imposes no PIA requirement)
- Honour breach notification timelines set by the strictest applicable law
- Respond to access and correction requests under the law that applies to the custodian holding the record (usually me, in my province of practice)
- Cooperate with the privacy commissioner of any province whose law applies to your record
N. Client acknowledgment
[PHIPA s.18 / HIA s.34 (written or electronic consent) / BC PIPA ss.6-9: consent given without deception or coercion]
Please read each statement and check the box to confirm:
- I have read and understand this cross provincial addendum
- I understand which privacy laws apply to the care I receive from you
- I understand what changes if my province of residence changes during care
- I understand that where more than one law applies, you will follow the higher standard
- I agree to notify you in writing if my primary province of residence changes
- I consent voluntarily to the cross provincial handling of my personal health information as described above
Client name (print): [___]
Client signature: [___]
Date: [___]
Therapist signature: [___]
Date: [___]
How to use this addendum
Three steps:
- Print or attach it to the consent form you already use at intake. If you use T-1 (PHIPA + CRPO consent form template), this addendum continues the section lettering at I.
- Walk through Sections I, J, and K with the client before they sign. The other sections are reference material the client can read on their own.
- Re sign Sections K through N if the client’s province of residence changes mid care. Keep both signed versions in the client’s file.
If the client only ever lives and receives care in one province, you don’t need this addendum. Your base consent form covers it.
This template is for informational purposes. Review with your provincial regulatory college or legal counsel before use.
This content is for informational purposes only and does not constitute legal advice. Privacy regulations vary by province and are subject to change. Verify current requirements with your provincial regulatory body and privacy commissioner.
Curio encrypts your Gmail for Canadian mental health privacy law and logs every send in a Canadian audit trail, which helps with the encryption and audit-logging safeguards in Section M whether your client is in Ontario, Alberta, or BC. If you use Gmail with cross provincial clients, see how Curio works.
Related reading: