Therapist email policy template

This template is for informational purposes. Review with your regulatory body or legal counsel before use.

Every therapist who emails clients needs a written email policy. Not because it’s fun to write policies, but because PHIPA, HIA, and PIPA all require documented safeguards for personal health information (PHI). A policy turns “I think my email is fine” into “here’s exactly how I protect client information, and here’s what happens if something goes wrong.”

This template gives you a complete internal email policy you can copy into a Word doc, fill in your practice details, and file. It’s written for solo practitioners but includes a staff training section for group practices with two to five clinicians.

The policy below is pan-Canadian. Where Ontario, Alberta, and BC requirements differ, you’ll find variant sections marked by province. Pick the section that matches your jurisdiction, or keep all three if you practise across provincial lines.

Email policy: [Practice Name]

Effective date: [Date]

Last reviewed: [Date]

Applies to: [Your Name / All staff at Practice Name]

Province: [Ontario / Alberta / BC]

1. Scope

This policy governs all email communication containing personal health information (PHI) sent or received by [Practice Name]. It applies to:

• Client communication (scheduling, session follow up, resources, clinical correspondence)
• Inter-provider communication (referrals, consultation notes, shared care)
• Administrative email containing PHI (insurance documentation, receipts linked to service dates and diagnostic codes)

This policy does not cover email that contains no PHI (e.g., general inquiries from prospective clients before intake, vendor correspondence, or professional development communication).

2. Encryption requirements

All outbound email containing PHI must be encrypted in transit. “Encrypted in transit” means the message content is protected between the sender’s mail server and the recipient’s mail server using TLS 1.2 or higher, or delivered through a secure portal.

Minimum standard: TLS 1.2 enforced on all outbound PHI messages. If the recipient’s server does not support TLS, the message must be delivered through an encrypted portal or secure alternative.

Implementation at [Practice Name]: [Describe your encryption setup. Example: “All client facing email is sent through Curio, which verifies TLS support on the recipient’s server and falls back to an encrypted portal when TLS is unavailable.”]

What is NOT considered encrypted: Standard Gmail or Outlook without additional encryption tooling. “Confidentiality notices” in email footers do not constitute encryption.

Provincial context: encryption obligations

Ontario (PHIPA s.12(1)): Health information custodians must take steps that are reasonable in the circumstances to ensure PHI is protected against theft, loss, and unauthorized use or disclosure, and that records are protected against unauthorized copying, modification, or disposal. Encryption is the IPC’s recommended safeguard for email containing PHI.

Alberta (HIA s.60): Custodians must take reasonable steps to maintain administrative, technical, and physical safeguards that protect the confidentiality of health information and the privacy of individuals who are the subjects of that information. Encryption of email containing health information satisfies the technical safeguard requirement.

BC (PIPA s.34): Organizations must protect personal information in their custody or control by making reasonable security arrangements against risks such as unauthorized access, collection, use, disclosure, or disposal. For email containing health related personal information, encryption is considered a reasonable security arrangement.

3. Retention periods

Email records containing PHI are retained for the period required by applicable provincial legislation, regulatory body guidelines, and any contractual obligations.

Retention schedule at [Practice Name]:

Provincial minimums

Ontario: CRPO requires therapists to retain client records for 10 years from the date of last contact (or 10 years after a minor turns 18). PHIPA does not prescribe a specific retention period but requires custodians to have a written retention policy.

Alberta: CAP requires psychologists to retain records for at least 10 years after the last professional service. The HIA does not set a clinical record retention period (s.41(2) requires only that a 10 year notation of certain disclosures be kept); retention for private practice comes from college standards plus the general duty to safeguard records.

BC: CHCPBC practice standards (when effective November 2027) will set retention requirements for registered therapists. Until then, PIPA requires organizations to retain personal information only as long as necessary to fulfill the purposes for which it was collected.

Destruction method: At the end of the retention period, email records are destroyed using [method: e.g., permanent deletion from email servers and backups, certificate of destruction from service provider].

4. Consent process

Before communicating PHI by email with a client, [Practice Name] obtains informed consent using the following process:

1. Provide the consent form. At intake (or before first email communication), present the client with a written consent form that explains: what email will be used for, what encryption protects and what it does not, the risks of email communication, and alternatives to email.

2. Allow questions. Give the client time to ask questions. Do not rush consent.

3. Obtain signature. The client signs the consent form. Store the signed form in the client record.

4. Document in the clinical record. Note the date consent was obtained and which communication channels the client consented to.

5. Review annually. At each annual review (or sooner if circumstances change), confirm the client still consents to email communication.

6. Withdrawal. If a client withdraws consent, stop email communication within [___] business days and switch to an alternative channel. Document the withdrawal.

Provincial context: consent requirements

Ontario (PHIPA s.18): Consent must be knowledgeable (the client understands what they’re consenting to), relate to the information being collected/used/disclosed, and not be obtained through deception or coercion. For email, this means the client must understand the specific risks of electronic communication before consenting.

Alberta (PIPA, plus CAP standards; HIA only for custodians): Most private practice therapists in Alberta are PIPA organizations, not HIA custodians. The custodian list is set by regulation (HIR s.2) and does not include private practice psychologists, counselling therapists or social workers. Under PIPA, consent must be for purposes the individual has been told about and understands, and express consent is expected for health information and for sharing it with a third party. Alberta has no circle of care implied consent and no lock box mechanism, so every disclosure rests on the consent you actually obtained. HIA’s informed consent rules bind custodians, and reach you only where you work as an affiliate inside a custodian organization. Registered psychologists also answer to CAP’s Standards of Practice on top of PIPA.

BC (PIPA): PIPA requires that consent be meaningful. The individual must understand what personal information is being collected, the purposes, and to whom it may be disclosed. Organizations must make a reasonable effort to ensure the individual understands.

Template available: For a ready to use consent form that meets PHIPA s.18 and CRPO Standard 3.4 requirements, see the therapist email consent form template.

5. Breach response

A breach occurs when PHI is collected, used, disclosed, retained, or disposed of in a manner that contravenes the applicable privacy legislation. For email, common breaches include: sending PHI to the wrong recipient, unauthorized access to an email account, or loss of a device containing unencrypted PHI.

Breach response steps

1. Contain. Immediately limit the breach. Recall the email if possible. Change passwords if an account was compromised. Secure or remotely wipe lost devices.

2. Assess. Determine: what PHI was involved, how many clients are affected, whether the information was actually accessed, and the risk of harm.

3. Notify (mandatory). Report the breach as required by provincial legislation:

4. Document. Record: date and time of breach, date and time of discovery, description of the breach, PHI involved, individuals affected, containment actions taken, root cause analysis, and corrective measures.

5. Remediate. Address the root cause. Update this policy if the breach reveals a gap. Retrain staff if applicable.

Breach log

Maintain a breach log documenting all incidents, regardless of severity. Store the log in [location: e.g., secure practice management system, encrypted file]. Retain breach documentation for [___] years.

6. Staff training (group practices)

This section applies to practices with two or more clinicians or any support staff who handle PHI.

All staff at [Practice Name] who send, receive, or have access to email containing PHI must complete training on this policy before handling PHI and annually thereafter.

Training covers:

• This email policy (all sections)
• How to verify encryption is active before sending PHI
• How to identify a breach and escalate immediately
• Client consent procedures and where to find consent forms
• Retention schedule and destruction procedures
• Provincial legislation requirements relevant to their role

Training records:

Annual review:

This policy is reviewed annually on [Date] by [Responsible person]. All staff are notified of changes and re-sign acknowledgment.

7. Privacy impact assessment (Alberta)

This section applies to HIA custodians.

Under HIA s.64, custodians must prepare a privacy impact assessment (PIA) and submit it to the OIPC Alberta before implementing a new administrative practice or information system that affects the collection, use, or disclosure of health information. This is a custodian duty: the HIA designates which providers are custodians (physicians, regulated nurses, pharmacists, and others on the Health Information Regulation list), and most private practice psychologists, counselling therapists, and social workers are not on that list. If you practise as an affiliate inside a custodian organization (for example, a clinic with physicians), the custodian’s PIA obligation applies to systems you use there.

If you are a solo private practitioner, your governing privacy statute is Alberta PIPA, which has no PIA requirement. Confirm your status with your college before treating any PIA step as binding on you personally.

Policy acceptance

I have read and understand this email policy. I agree to follow the procedures described.

Name: [___]

Role: [___]

Signature: [___]

Date: [___]

This content is for informational purposes only and does not constitute legal advice. Privacy regulations vary by province and are subject to change. Verify current requirements with your provincial regulatory body.

Curio automates the encryption and audit trail steps referenced in sections 2 and 5. If you’re looking for encryption that works with your existing Gmail, join the waitlist.

Related reading:

• PHIPA requirements for therapist email
• Alberta HIA: what therapists need to know about email
• BC PIPA and therapist email privacy