By
Adam Simmons
· Last checked
October 2026
Teams can be part of a practice that meets PHIPA, but Microsoft does not call any plan compliant, and it is explicit about why. "There is no formal certification that cloud service providers can use to comply with Canadian privacy laws," and organizations using Microsoft online services "are wholly responsible for compliance with all laws and regulations applicable to them, including Canadian privacy laws" (Microsoft Learn, Canada privacy laws).
What Microsoft offers is a contractual commitment, its Data Protection Addendum, and data centres in Toronto and Québec City. Whether your Teams data is actually in Canada depends on when your account was set up.
The options therapists usually weigh against it are Zoom, the video in Jane or Owl Practice, and Rivet. Rivet is ours, so read this page with that in mind.
Where does Teams store a Canadian practice's data?
Microsoft's Teams documentation lists Canada as a supported region, then adds the catch: data residency in Canada is "for new tenants only", and "existing tenants in Brazil and Canada will continue to have their data stored in the Americas" (Location of data in Microsoft Teams).
A practice that set up Microsoft 365 some time ago may be storing Teams data in the Americas region without realizing it. You can check: Microsoft 365 admin centre, then Settings, Organization profile, Data location.
What does Microsoft put in writing?
Microsoft points to its Products and Services Data Protection Addendum for "privacy-related contractual commitments regarding data residency, security, access, breach notification", and states that under its terms "the responsibility and ownership of personal data lies with you." It describes privacy as "a shared responsibility between Microsoft as a cloud service provider and you as the customer."
What stays with you?
PHIPA's duty is the custodian's: to "take steps that are reasonable in the circumstances" to protect personal health information (PHIPA, s. 12(1)). With Teams, those steps include:
confirming your data location in the admin centre
multi-factor sign-in on every account that can see client information
meeting settings: lobby on, recording off unless you have consent
what your consent form says about the platform
Does my College care where it's stored?
It may. Ontario's social work College, for example, tells registrants to "ensure that client information is stored in a jurisdiction where the privacy laws are consistent with Ontario laws or, where applicable, Canadian federal laws" (OCSWSSW, Interpretation 5.3.1). If your admin centre shows the Americas, that's worth reading against your own College's standards.
How does Rivet compare?
Rivet sessions open from a link in your client's browser, with no app or Microsoft account on their side, and records are kept in Canada for every account. Rivet signs on as your agent under PHIPA in a data processing agreement you accept when you sign up. Measures, the whiteboard and EMDR open inside the session.
Stay with Teams if your practice already runs on Microsoft 365, your data location shows Canada, and your clients join without trouble.
About Rivet
Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.
$29 CAD a month per practitioner for the practice line, or $65 with video sessions and clinical tools. Fourteen-day trial, no card.