For an Ontario practitioner providing health care, client information is governed by Ontario's health privacy statute rather than the federal one. That is the short answer, and for day-to-day practice it is the whole answer.

The Privacy Commissioner of Canada lists Ontario's Personal Health Information Protection Act among the provincial health statutes that have been declared substantially similar to the federal act, alongside New Brunswick, Newfoundland and Labrador, and Nova Scotia (OPC). Where a substantially similar provincial law applies, organizations are generally exempt from the federal act for information handled within that province.

The federal act does not disappear entirely. The Commissioner's own wording: "even in those provinces, PIPEDA still applies to transactions involving personal information transferred across borders and federal works, undertakings or businesses (FWUBs) such as banks, telecommunications and transportation companies" (OPC).

Where does the federal act still touch a therapy practice?

Two places, in practice.

Cross-border handling. The sentence above is the load-bearing one. If client information moves out of the country — which it may, through a supplier — the federal act is in the picture for that movement even though your day-to-day record-keeping is provincial.

Your own business information that is not client health information. Employee records, contractor arrangements, marketing lists. The federal act applies "to every organization in respect of personal information that... the organization collects, uses or discloses in the course of commercial activities" (PIPEDA, s. 4(1)). The Commissioner puts the same threshold in plainer words: the act applies to "organizations that collect, use, or disclose personal information in the course of a commercial activity," and personal information "includes any factual or subjective information, recorded or not, about an identifiable individual" (OPC).

"Recorded or not" is wider than most people read it as. It is not limited to what is in a file.

What the federal act then asks for is a list you will recognise: accountability; identifying purposes; consent; limiting collection; limiting use, disclosure, and retention; accuracy; safeguards; openness; individual access; and challenging compliance. Those overlap heavily with what your College's confidentiality standard already asks of you, which is why working out which act governs rarely changes what you do on a given Tuesday. It changes who you would report to, and when.

Why does the distinction matter at all?

Because the two acts handle breaches differently, and that is when people suddenly need to know which one they are under.

The federal act's threshold is harm-based: an organization reports to the Commissioner where "it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual." "Significant harm" is defined to include "bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property" (PIPEDA, Division 1.1).

Ontario's health statute takes a different shape. Notification to the affected individual is triggered whenever information "is stolen or lost or if it is used or disclosed without authority," with no harm threshold at that step (PHIPA, s. 12(2)). Notification to the Commissioner is triggered only in prescribed circumstances.

So a small accidental disclosure can require telling the client under the health statute while falling below the federal reporting threshold. Knowing which regime you are in changes what you do on the day.

What about my College — is that a third thing?

Effectively yes, and it is the one most likely to affect you.

Your College's standards operate independently of either statute. Ontario's psychotherapy standards, for instance, require registrants to "familiarize themselves and comply with relevant privacy laws" (CRPO 3.1.2) — which makes the statute's requirements also a professional obligation, enforceable through the College's own process rather than the Commissioner's.

In other words, complying with the statute is necessary but the College can expect more than the statute's floor, and often does.

The practical version

Three sentences to carry around.

If you practise in Ontario and provide health care, your client information is under the provincial health statute. If information crosses the border, the federal act is also in the picture for that. If you are unsure which regime a particular situation falls into — an employee record, a research project, a client who lives in another province — that is a question for your College or a privacy lawyer, and it is a cheap question compared with getting it wrong.

For practitioners outside Ontario the map is different again, and worth reading separately: privacy law for therapists outside Ontario.

About Rivet

Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.

One plan, $65 CAD a month, everything included. Fourteen-day trial, no card.

See what's included · Start the trial