By
Adam Simmons
· Last checked
September 2026
No video platform can satisfy PHIPA for you, whatever its website says. Under Ontario's health privacy law the duty sits with you, the health information custodian: the law asks you to take "steps that are reasonable in the circumstances" to protect your clients' information. A platform can make those steps easy or hard to show.
The video options Canadian therapists usually weigh are the video built into Jane or Owl Practice, Doxy.me, Zoom, and Rivet. Rivet is ours, so read this page with that in mind.
For privacy, the difference between them is rarely the call itself. It is where client information is stored, what the vendor will put in writing about how it handles it, and who on the vendor's side can see it. Those are questions you can ask any platform, and the answers belong in your file.
Who is responsible under PHIPA?
PHIPA's list of health information custodians starts with "a health care practitioner or a person who operates a group practice of health care practitioners". A health care practitioner includes "a person who is a member within the meaning of the Regulated Health Professions Act, 1991 and who provides health care", and separately "a person who is a member of the Ontario College of Social Workers and Social Service Workers and who provides health care" (PHIPA, ss. 2 and 3).
The core duty is section 12(1): a custodian "shall take steps that are reasonable in the circumstances to ensure that personal health information in the custodian's custody or control is protected against theft, loss and unauthorized use or disclosure" (PHIPA, s. 12(1)).
Outside Ontario, your own province's health privacy law and your College's standards apply instead. The questions below are the same.
What does the law say about the platform?
The vendor has duties too. A company that supplies services so a custodian can handle health information electronically, and isn't the custodian's agent, "shall not use any personal health information to which it has access in the course of providing the services ... except as necessary in the course of providing the services", and "shall not disclose any personal health information to which it has access" (O. Reg. 329/04, s. 6(1)).
Those duties sit alongside yours. They don't replace them.
What does "PHIPA compliant" on a vendor's page mean?
PHIPA itself doesn't certify vendors. When a platform calls itself compliant, it usually means the vendor believes its product lets you meet your own obligations. That may well be true, but it is a claim to check rather than an answer.
Your College may also have expectations about where records live. Ontario's social work College, for example, tells registrants to "ensure that client information is stored in a jurisdiction where the privacy laws are consistent with Ontario laws or, where applicable, Canadian federal laws" (OCSWSSW, Interpretation 5.3.1).
What should I ask a video platform?
Where are client records stored: names, appointments, notes and anything else the platform keeps between sessions?
Does the video itself pass through your servers, and are sessions recorded?
Will you put in writing how you handle client information?
Who on your side can access it, and under what agreement?
What happens to the information if I leave?
A vendor that answers these plainly, in writing, has given you what you need for your file. One that only repeats the word "compliant" has not.
How do the usual options answer?
Jane or Owl Practice video. Included in their plans and tied to your schedule and chart. Ask them the questions above; the records they hold for video are the same records they hold for the rest of your practice.
Doxy.me. Its help centre says "Doxy.me servers are located in the USA", and that on individual calls the audio and video flow "directly between the two individuals on the call, not through doxy.me servers" (Doxy.me server location). Whether US-hosted account records are acceptable is a decision for you and, where it applies, your College.
Zoom. Familiar and inexpensive. Check which plan you are on, where your account data is held, and what Zoom will put in writing for that plan.
Rivet. Your client joins from a link in their browser, with no download or account. Client records are kept in Canada, and how Rivet handles them is set out in a data processing agreement you accept when you sign up. Measures, the whiteboard and EMDR open inside the session.
The short version
No platform makes you compliant. Pick one whose answers to those five questions you can write down and keep on file.
About Rivet
Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.
$29 CAD a month per practitioner for the practice line, or $65 with video sessions and clinical tools. Fourteen-day trial, no card.