Twenty questions Canadian therapists ask about email under PHIPA, Alberta and BC PIPA, and, for custodians, Alberta’s HIA. Each answer stands on its own. Skim, search, or read straight through.
Crisis resources. If a client is in crisis, do not respond by email. Direct them to the 9-8-8 Suicide Crisis Helpline (call or text 988). Email is not a crisis channel.
Encryption and infrastructure
Is Gmail PHIPA compliant?
Gmail is not PHIPA compliant out of the box. It uses opportunistic TLS, which means client emails can be sent unencrypted if the recipient server does not support TLS. Under PHIPA s.12(1), health information custodians must take reasonable steps to protect personal health information. Opportunistic encryption is not a reasonable step on its own.
Learn more: Is Gmail PHIPA compliant for Ontario therapists?
What encryption does PHIPA require for email?
PHIPA does not name a specific encryption standard, and the s.12(1) duty is to take “steps that are reasonable in the circumstances” to protect personal health information. The Information and Privacy Commissioner of Ontario (IPC) does not, in its email guidance, mandate encryption or a specific protocol; what matters under the statute is the circumstances, and for mental health information in transit, encryption is the expected safeguard. Encryption is the widely expected safeguard for PHI in transit, which in practice means TLS required on every send, or end-to-end encryption, with a portal fallback when TLS cannot be established.
Learn more: PHIPA email requirements for therapists
Can therapists email clients under PHIPA?
Yes, therapists can email clients under PHIPA, but with conditions. The client must provide knowledgeable consent after being told the risks of email, and the practice must take steps that are reasonable in the circumstances to protect the information (in practice, encryption). PHIPA does not prohibit email; it requires reasonable safeguards.
Learn more: Can therapists email clients under PHIPA?
Do all provinces require email encryption for therapists?
Not in the words of the four statutes covered here. PHIPA s.12(1) asks for steps that are reasonable in the circumstances, and Alberta and BC PIPA s.34 ask for reasonable security arrangements. None of the three mentions encryption, and PIPEDA names it only as an example. Regulators’ guidance goes further. Ontario’s Information and Privacy Commissioner says you should encrypt email with clients where you can, and must tell clients about your written email policy and get their consent before using unencrypted email. The BC Physician Privacy Toolkit says personal information on portable devices must be protected by industry standard encryption. Alberta’s commissioner names encryption only as an example or as advice. That guidance isn’t law, and in practice encryption is how the duty is met for email.
Learn more: PHIPA vs HIA vs BC PIPA: a therapist’s guide
Is Hushmail better than Gmail for Canadian therapists?
Hushmail encrypts messages itself (a per message toggle by default); Gmail’s own message level encryption needs a higher Google Workspace edition, such as Enterprise Plus. For therapists who want a single-provider solution, Hushmail removes the encryption gap. The trade-off: its secure messages go through a separate Hushmail inbox rather than Gmail, even if you keep Gmail for everything else, and it uses its own audit logging rather than your Workspace audit log. Hushmail is headquartered in Vancouver. Whether it is “better” depends on whether you want secure mail in a separate inbox or kept in Gmail under a compliance layer.
Learn more: Hushmail vs Gmail for Canadian therapists
Is Paubox PHIPA compliant?
Paubox is a US-based email encryption service marketed as HIPAA compliant. It encrypts email at the gateway, which is one way to meet a safeguards duty. Its security documentation names no Canadian privacy statute and no Canadian region. For Canadian therapists, the question to ask Paubox is where it processes and stores your data, and how that fits your province’s safeguards duty (PHIPA s.12(1), or Alberta and BC PIPA s.34).
Learn more: Is Paubox PHIPA compliant in Canada?
Consent, retention, and recordkeeping
What should a therapist email consent form include?
A PHIPA aligned email consent form should name the practice, describe the purpose of email use, list the risks (interception, misdelivery, unauthorized access on the recipient’s device), state what safeguards are in place, give the client a way to withdraw consent, and be signed and dated. Verbal consent is allowed under PHIPA but harder to defend later.
Learn more: Consent form template for PHIPA + CRPO
How long must therapists retain email records under PHIPA?
PHIPA itself does not set a specific email retention period. CRPO Standard 5.1 requires Ontario psychotherapists to retain client records for at least 10 years from the last interaction, or 10 years from the client’s 18th birthday, whichever is later. Email exchanges that are part of the clinical record fall under the same rule. Operational emails can be retained for shorter periods if documented.
Learn more: Email retention policies for Ontario therapists
Can I use my personal email for client communication under PHIPA?
No. A personal email account (gmail.com, outlook.com, yahoo.com) almost certainly fails PHIPA’s reasonable safeguards test. Personal accounts lack admin controls, audit logging and retention policies. Use a dedicated practice account on Google Workspace, Microsoft 365, or a comparable business email service.
Do therapists need a separate email account for client communication?
Best practice is yes. A dedicated client email account, separate from billing, marketing, and personal correspondence, makes audit trails cleaner, simplifies retention, and reduces the risk that PHI ends up in a thread it should not be in. Some practices use one account per therapist; group practices often use shared aliases with strict access logging.
Provincial differences
What is the difference between PHIPA and PIPEDA?
PHIPA is Ontario’s health-specific privacy law and applies to health information custodians. PIPEDA is the federal private sector privacy law; it applies across Canada except where a province has substantially similar legislation, such as Alberta and BC PIPA or, for health information custodians, Ontario’s PHIPA. Where PHIPA applies, it generally takes precedence for PHI. PIPEDA can still apply to commercial activities of an Ontario therapist (for example, marketing) and to interprovincial transfers.
Learn more: Email privacy laws across Canada (Ontario, Alberta, BC)
Does PHIPA apply to therapists in Alberta?
No. PHIPA is Ontario legislation. In Alberta, most private practice therapists are governed by the Personal Information Protection Act (PIPA Alberta) together with their college standards; the Health Information Act (HIA) applies to designated custodians and reaches a therapist as an affiliate when they handle health information for one. The substantive safeguards are similar, but section numbers, definitions, and the regulator (OIPC Alberta) differ.
Learn more: Alberta HIA email requirements for therapists
How does HIA differ from PHIPA?
Alberta’s HIA covers a defined list of “custodians.” Most private practice psychologists and counselling therapists are not designated custodians; they fall under Alberta’s PIPA and college standards, and HIA reaches them as affiliates when they handle health information for a custodian. PHIPA’s “health information custodians” list is scoped differently. HIA s.64 requires custodians to prepare a privacy impact assessment and submit it to OIPC Alberta before implementing a new health information system; PHIPA encourages but does not statutorily mandate PIAs. Breach notification timelines and content also differ.
Learn more: PHIPA vs HIA vs BC PIPA: a therapist’s guide
What happens when my client moves to another province?
Your own province’s privacy law always governs you, so if you are licensed in Ontario and your client moves to Alberta, you are still bound by PHIPA for the records you hold. Alberta’s law may also apply, and how far it reaches is unsettled, so get advice before you keep working with a client across a provincial border. Cross-border telehealth raises additional questions: provincial college rules, tax residency, and whether you are authorized to practice in the new province.
Learn more: Cross provincial compliance quick start
What is the CHCPBC and when does regulation start?
The College of Health and Care Professionals of British Columbia (CHCPBC) is BC’s amalgamated regulatory college for several health professions. Psychotherapy regulation under CHCPBC is scheduled to begin November 29, 2027. After that date, BC psychotherapists will fall under formal college oversight, which will include privacy, recordkeeping, and consent expectations.
Learn more: CHCPBC psychotherapy regulation in BC (2027)
Regulatory enforcement
What are PHIPA administrative monetary penalties?
PHIPA was amended in 2020 to authorize administrative monetary penalties (AMPs) under s.61.1. The IPC can order penalties for contraventions of PHIPA, with caps of $50,000 for individuals and $500,000 for organizations set by O. Reg. 329/04 s.35 (in force January 1, 2024). Decision 298, issued August 27, 2025, was the first IPC decision to actually impose an AMP, signalling that enforcement risk is no longer theoretical for Ontario therapists.
Learn more: PHIPA administrative monetary penalties: Decision 298
What is CRPO Standard 3.4?
CRPO Standard 3.4 is the College of Registered Psychotherapists of Ontario standard governing electronic practice. It requires Ontario psychotherapists to maintain informed consent specific to electronic communication (3.4.2), take reasonable steps so the technology is secure (3.4.3), and keep copies of email correspondence in the clinical record (3.4.6). It is the practical bridge between PHIPA’s general safeguards requirement and day-to-day email and telehealth decisions.
Learn more: CRPO electronic practice standards for email
What counts as a privacy breach under PHIPA?
Under PHIPA, a privacy breach is the loss, theft, or unauthorized use, disclosure, or access of PHI. That includes a misdirected email, a lost laptop with client records, or a contractor accessing files without authorization. Custodians must notify affected individuals at the first reasonable opportunity and notify the IPC if the breach meets the prescribed circumstances.
What is a privacy impact assessment?
A privacy impact assessment (PIA) is a structured review of how a new system, process, or vendor handles personal information. It documents what data is collected, where it flows, what risks exist, and what safeguards are in place. Alberta’s HIA s.64 requires custodians to prepare a PIA and submit it to OIPC Alberta before implementing a new health information system or practice; PHIPA strongly encourages PIAs but does not statutorily require them. PIAs are also a useful internal tool when adopting any new email or telehealth product.
Learn more: PHIPA privacy impact assessment template
Is texting a client subject to PHIPA?
Yes. SMS and messaging app conversations that contain PHI are subject to PHIPA’s safeguards requirement, the same as email. SMS has weaker security than encrypted email, no audit trail by default, and stores messages on the carrier and device. If you text clients, get knowledgeable consent, limit content to non-clinical logistics where possible, and document the practice.
Learn more: Can therapists email clients under PHIPA?
How Curio fits in
Curio handles email encryption and maintains a Canadian audit trail for every send, working with your existing Google Workspace. Encryption is automatic at runtime. The audit trail is hosted on Canadian servers in Montreal. Your Gmail stays the same; the compliance infrastructure runs underneath.