Yes. And the more useful question is what the consent has to be about, because "is it okay if I text you?" is not the thing the standards are describing.

For registered psychotherapists in Ontario the requirement is stated plainly: "Registrants obtain informed consent from clients regarding the use of electronic communication media in the provision of services" (CRPO 3.4.2). The same standard requires registrants to "take reasonable steps to ensure that the technology employed is secure, confidential, and appropriate, given the needs of the client" (3.4.3).

Consent here is informed consent — meaning the client understands what they are agreeing to, including the risks. The commentary is explicit that the risk disclosure is part of it: "When a registrant intends to use an electronic medium, clients should be made aware of any potential risks, particularly an inability to ensure security and confidentiality, that could arise from the use of the technology."

The same commentary asks for something more than a yes. A registrant "is expected to enter into an agreement with the client concerned" before providing services by electronic communication technology, and should "outline appropriate uses of technologies with clients (e.g., emailing or texting only for booking appointments, secure online platforms for the provision of therapy)." That worked example is the College's own, which is worth knowing if the line you want to draw is the narrow one.

What does the consent actually have to cover?

The Ontario privacy commissioner's guidance on email is the most concrete public description of what an informed consent to an insecure channel looks like — and it is worth being precise about what it is. It is written about email. The commissioner has published nothing addressed to text messaging, and the nearest bridge is a single sentence in its virtual-care guidance: "The following discussion focuses on communicating personal health information by email. Similar rules should apply to communicating personal health information by secure messaging" (IPC, Privacy and security considerations for virtual health care visits).

Read that before leaning on it. The same document describes secure messaging as something clients "should be registered through" and which "authenticates their identity before accessing their messages" — a portal, not ordinary SMS. The reasoning below transfers usefully to text. The endorsement is not there.

"Custodians must notify their patients about their written email policy and obtain their consent prior to the use of unencrypted email. The consent should be in plain language and indicate the types of information that may or may not be communicated by unencrypted email, the risks of using unencrypted email and the circumstances where the custodian will use unencrypted email" (IPC fact sheet).

The same fact sheet gives the narrow-channel example many practitioners land on: "custodians may limit the use of unencrypted email to the scheduling of appointments only and have a policy of not sending or receiving any clinical information via unencrypted email."

And it notes that consent can be given in more than one way: "if patients provide their email addresses in writing, such as by completing a form, the form can include information on the risks involved... This can also take the form of verbal discussion, if and when individuals provide their email addresses orally."

Does a client texting me first count as consent?

Treat it as a starting point, not as consent.

A client who texts you has plainly agreed to something, but they have not been told what the channel is for, what you will and will not send back, how quickly you respond, or that the exchange forms part of their record. The Ontario social work practice notes work through what happens when that last part is never disclosed. A client emails between sessions, and "At the next session, the member discusses the email with the client, explaining that the email is part of the client's clinical record." The client had not known. The relationship does not survive it (OCSWSSW practice notes).

The College's own guidance asks members to check that clients know "The fact that messages received through communication technology may become part of their client record?" (OCSWSSW, Top 10 Considerations for Using Communication Technology in Practice).

Does the consent need to be in writing?

Your College may or may not require it. The psychotherapy standard requires a contract before providing services by communications technology, and the College's guideline addresses the form: "While the Standard does not specify that this contract must be in writing, registrants are encouraged to establish a written agreement with the client. Where no written contract exists, communications with the client regarding terms for services provided via electronic communications technology must be documented in the clinical record" (CRPO Electronic Practice Guideline).

Note the fallback in that sentence. There is no "we discussed it and I didn't write it down" option — either the agreement is written, or the conversation is.

For other professions and other provinces the requirement is sometimes stricter, and one of them is a real step up.

The CCPA standards — which the Nova Scotia College of Counselling Therapists publishes as its own — ask for a document rather than a conversation: "Counsellors/therapists shall maintain a written policy with respect to electronic communication with clients. This policy must be shared with clients as part of an informed consent process." The accompanying code puts the consent in the same terms: counsellors "seek client informed consent prior to using Internet-based communication with clients (e.g., email, texting, and related forms of digital communication)" and "apprise clients of associated risks" (H2) (CCPA Standards of Practice).

Ontario social work asks for the documentation without prescribing the form: "Clients may sign consent forms or provide verbal consent; College registrants shall document that consent was obtained" (OCSWSSW 5.2.1).

Ontario psychology is the same shape. Consent obtained in writing, "physical or via secure technology, is preferred. However, oral consent is acceptable and must be documented in the client's file" (CPBAO Standard 7.1(c)).

Alberta social work names what the consent has to be about: a social worker "will address the identifiable risks, benefits, and limitations of social work services provided through the electronic medium chosen when obtaining consent to provide services electronically" (ACSW E.3(k)).

Four regulators, one pattern. It does not have to be a form. It does have to be written down somewhere, and the somewhere is usually the file.

Does the consent expire, or change?

Two situations come up.

The channel drifts. Consent given for scheduling does not cover clinical content that starts arriving six months later. When the use changes, the conversation is due again.

The client changes their mind. Withdrawal of consent to a channel is a normal thing and should be easy — which mostly means having somewhere else for them to reach you, so that withdrawing does not mean going unreachable.

The practical shape of this

Most practitioners end up with one paragraph in their intake paperwork and one sentence said aloud in the first session. The paragraph covers what the channel is for, what it is not for, the response-time expectation, that the channel is not secure, and that messages form part of the record. The sentence is: "text me about scheduling, and if something is urgent, here is what to do instead."

The full version of that paragraph is worked through in what to put in a communications consent form.

About Rivet

Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.

One plan, $65 CAD a month, everything included. Fourteen-day trial, no card.

See what's included · Start the trial