You cannot get a straight answer because the question does not have one. No regulator in Canada certifies communication tools for therapy practice, and no product can be compliant on your behalf. The obligation sits on you, and what a tool can do is make meeting it easier or harder.

Ontario's psychotherapy College says this about itself, in writing: "CRPO can't recommend a specific platform because technology is constantly evolving and there are so many options available," and, of the platforms it does mention, "CRPO cannot attest to the effectiveness or appropriateness of these platforms" (CRPO, selecting a communications platform).

That is the straight answer you were looking for. Nobody is going to bless the app. What the standard asks is that you "take reasonable steps to ensure that the technology employed is secure, confidential, and appropriate, given the needs of the client" (CRPO 3.4.3) — which is a duty of care about a decision you made, not a property of the software.

Ontario psychology puts the same duty on you in more pointed terms. Registrants "must verify the practices of their technology provider and seek guidance from relevant authorities (for example, the relevant Information and Privacy Commissioner) if uncertain about the current minimum requirements," and where a service is hosted externally the registrant "must ensure the service operator acts in compliance with legislation" while remaining "responsible for information collection, use, disclosure, and secure destruction by the agent" (CPBAO Standards 9.5(b) and 9.5(c)).

Verify, and stay responsible. That is the shape of every version of this rule.

So the question worth asking is: can I explain why I chose this, and does the choice hold up?

Why do vendors say "compliant" then?

Because it sells, and because the word has no fixed meaning in this context.

Watch for three specific shapes.

A framework name used as an adjective. A tool described as "PHIPA-compliant" is making a claim about a statute that places obligations on custodians, not on software. There is no certification behind it.

An American framework offered to a Canadian practice. HIPAA is US law. A product built for it may well be well-engineered, and that is genuinely worth something — but it says nothing about Canadian storage, Canadian regulators, or your College.

A security certification standing in for a privacy answer. An audit certification tells you a company follows its own stated controls. It does not tell you where your clients' information lives or who can read it.

None of these is necessarily dishonest. They are just answers to different questions than the one you asked.

What actually makes a tool defensible

Five things, all of which you can check before you sign up.

You can say where the information is held. Country and region, not "the cloud." See is my client data stored in Canada.

You can name who else touches it. Telephony, hosting, email, and — separately and specifically — any third-party AI service. Ontario's psychotherapy College puts that last one on its own security checklist: "You do not enter personal health information into an AI tool unless the terms of service provide for confidentiality" (CRPO, Security Practices Checklist — Electronic Practice). Which means the question is not whether a product uses AI. It is whose AI, under whose terms.

There is a written agreement you can hand to a reviewer. Ontario's regulation sets out what such an agreement covers in the context of certain service providers, including a description of "the administrative, technical and physical safeguards relating to the confidentiality and security of the information" (O. Reg. 329/04, s. 6(3)).

You can get information out. Retention obligations outlive subscriptions. A tool you cannot export from is a tool that will eventually own part of your record.

The client-facing behaviour matches what you told the client. If your consent paragraph says texts are for scheduling and the tool auto-sends something else, the mismatch is yours.

Where a plain second-line app is genuinely fine

If you use a second number purely so clients are not calling your personal handset, if nothing clinical is exchanged on it, if you document what needs documenting in your chart, and if you have told clients what the channel is for — a basic second line from a mobile carrier is a reasonable choice and cheaper than almost anything else. It is a phone number. Phone numbers have been part of practice for a century.

The case for a purpose-built tool starts when the volume gets high enough that transcribing into the chart stops happening, or when you need the record and the channel to be the same thing, or when a reviewer starts asking questions a carrier cannot answer.

What to do when a vendor will not answer

Ask in writing, once, with the four questions from is my client data stored in Canada. Keep the reply, or keep the non-reply.

A vendor who cannot say where their database is has answered you. Not the answer you wanted, but a usable one.

About Rivet

Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.

One plan, $65 CAD a month, everything included. Fourteen-day trial, no card.

See what's included · Start the trial