By
Adam Simmons
· Last checked
October 2026
Zoom can be part of a practice that meets PHIPA, but no Zoom plan is compliant on its own, and Zoom says so. Its own PIPEDA/PHIPA datasheet answers the question "Are there any PIPEDA or PHIPA certification programs?" with: "No. Currently there are no PIPEDA or PHIPA certification programs to assess third-party compliance" (Zoom PIPEDA/PHIPA datasheet).
What Zoom offers Canadian health practices is Zoom for Healthcare with a signed data protection agreement. What it doesn't change is that the duty sits with you, the custodian.
The video options therapists usually weigh against it are the video in Jane or Owl Practice, Doxy.me, and Rivet. Rivet is ours, so read this page with that in mind.
What does Zoom actually say?
The same datasheet says Zoom supports PIPEDA and PHIPA obligations through "the execution of 'Data Protection Agreements' to contractually establish adequate transfer mechanisms", along with encryption in transit and "no monitoring, viewing, or tracking of the video or audio content of your video meetings."
It is also direct about data location: "Data does not need to remain in Canada in order to comply with either of these privacy laws. As long as adequate transfer mechanisms are in place, Canadian data can be stored in the United States." That is Zoom's reading of the law. Your College may expect more; ask it, or check its published guidance on electronic practice.
Which Zoom are we talking about?
Most therapists asking this are on a regular Zoom plan. The datasheet describes Zoom for Healthcare and the agreement that goes with it. A free or standard account without that agreement is a different arrangement.
The free plan has a second problem: Zoom's pricing page caps free meetings at 40 minutes (Zoom pricing), which a fifty-minute session does not fit.
What stays with you either way?
PHIPA puts the duty on the custodian: to "take steps that are reasonable in the circumstances" to protect personal health information (PHIPA, s. 12(1)). A vendor's agreement is one of those steps. The rest is yours:
the plan you're on, and whether the agreement is actually signed
meeting settings: waiting room, passcodes, recording turned off unless you have consent to record
what you tell clients about the platform in your consent form
where any recording or chat log ends up, if one exists
What should I ask Zoom, or any platform?
Is there a signed agreement covering client information, and does my plan include it?
Where are account records and any recordings stored?
Who on your side can access them?
What happens to my data if I cancel?
How does Rivet compare?
Rivet sessions start from a link in your client's browser, with no app and no account, and records are kept in Canada. Rivet signs on as your agent under PHIPA in a data processing agreement you accept when you sign up. Measures, the whiteboard and EMDR open inside the session, and the same app carries a practice phone line. It is $65 CAD a month with the clinical tools, and fourteen days free.
Stay with Zoom if you already run Zoom for Healthcare with a signed agreement, your clients are comfortable with it, and video is all you need in the hour.
About Rivet
Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.
$29 CAD a month per practitioner for the practice line, or $65 with video sessions and clinical tools. Fourteen-day trial, no card.