Almost everything written for Canadian therapists about privacy is written about Ontario, and Ontario's health privacy act does not apply outside Ontario. If you practise elsewhere, the statute that governs your client information is probably a general private-sector privacy law rather than a health-specific one — which changes the vocabulary, the thresholds and the regulator you would deal with.

The Privacy Commissioner of Canada divides the map two ways. "Alberta, British Columbia (B.C.) and Quebec have their own private-sector privacy laws that have been deemed substantially similar to PIPEDA." Separately, New Brunswick, Newfoundland and Labrador, Nova Scotia and Ontario have health-specific statutes declared substantially similar (OPC).

Three provinces sit outside both halves of that map — Manitoba, Saskatchewan and Prince Edward Island. Each has a health-information statute of its own, and because none of them is on the federal list, the federal act keeps applying alongside it.

British Columbia

For a private practice, the operative statute is the province's Personal Information Protection Act. Its security provision reads: "An organization must protect personal information in its custody or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks" (PIPA, s. 34).

The College names both of the province's statutes and draws the line between them. The Freedom of Information and Protection of Privacy Act "regulates the privacy practices of public bodies (and those who provide health services within public bodies)"; the Personal Information Protection Act "regulates the privacy practices of individuals and organizations in the private sector" (CHCPBC, Practice Standard: Privacy and Confidentiality).

Note what is not on that list. BC has no separate private-sector health-information act — no equivalent of Ontario's. A private practice sits under the general private-sector law, which is a real difference in vocabulary and in who you would deal with.

The same standard sets two things worth knowing before you need them. Access requests are answered "within 30 business days of receiving a request from a patient or authorized individual" (§5.1). And on a breach, licensees "Take prompt steps to contain a privacy breach and prevent a reoccurrence" (§7.1), reporting it in the manner privacy legislation requires.

The BCACC documentation standard for clinical counsellors points at the provincial commissioner directly, requiring the counsellor to report "privacy breaches to the Office of the Information and Privacy Commissioner for British Columbia (OIPC) to ensure management and mitigation of risk" (BCACC 12.12).

Whether the statute itself compels that report, or the professional standard does, is a distinction worth getting right before you need it — and worth pairing with the fact that counselling is not yet a regulated profession in BC, so that standard binds through association membership rather than through a licence.

Alberta

Alberta has both a general private-sector act and a health-specific one, and the intuitive guess about which one covers a therapist is the wrong one.

The provincial commissioner describes the split this way. The Personal Information Protection Act "applies to private organizations, such as businesses, employees, partnerships, trade unions and professional regulatory bodies." The Health Information Act "applies to 'custodians', such as government departments responsible for health services in Alberta, provincial health agencies..., hospital services..., pharmacies and pharmacists, physicians, optometrists, registered nurses, dentists, and their health service providers or employees" (OIPC Alberta).

That list is illustrative rather than exhaustive, and psychologists, social workers and counsellors do not appear on it. The College of Alberta Psychologists closes the gap in its own guide to the province's privacy legislation, and the answer is the opposite of the one most people expect:

"Currently, psychologists are not designated as custodians under the HIA. However, psychologists employed or contracted by custodians are considered 'affiliates' under the HIA and are required to collect, use, and disclose health information in accordance with the HIA."

"PIPA generally applies to psychologists working in private practice or private clinics."

— CAP, Interpretive Guide: Privacy Legislation in Alberta

Its worked example is a solo practice opening its doors: "A psychologist recently opened their own clinic to provide psychological services to clients... PIPA governs this collection of information as the psychologist is working in a private clinic and not a public body. Additionally, psychologists are not defined as custodians under the HIA."

So in Alberta the health act is not your act, and reaching for it because it has "health" in the title is the mistake to avoid. The employment relationship is what changes the answer: work for a custodian and you become an affiliate under the health act; work for yourself and you are under the private-sector one.

That is published for psychologists. For social workers and counsellors, confirm with your own College rather than reading across — the answer turns on how each profession is designated, not on what the work looks like.

Quebec

Quebec's private-sector act is the most prescriptive of the three, and the requirements are unusually concrete.

On sending information out of the province: "Before communicating personal information outside Québec, a person carrying on an enterprise must conduct a privacy impact assessment," and "the communication of the information must be the subject of a written agreement." The same obligation applies "where the person carrying on an enterprise entrusts a person or body outside Québec with the task of collecting, using, communicating or keeping such information on his behalf" (P-39.1, s. 17).

On incidents: a person who "has cause to believe that a confidentiality incident involving personal information the person holds has occurred must take reasonable measures to reduce the risk of injury and to prevent new incidents of the same nature," and "if the incident presents a risk of serious injury," must "promptly notify the Commission d'accès à l'information" and "any person whose personal information is concerned by the incident" (s. 3.5).

There is also a register requirement: "A person carrying on an enterprise must keep a register of confidentiality incidents" (s. 3.8).

A "confidentiality incident" is defined broadly — unauthorised access, use or communication, "or loss of personal information or any other breach of the protection of such information" (s. 3.6).

Manitoba, Saskatchewan and Prince Edward Island

Each of these three has a health-information statute, and none of them appears on the federal commissioner's substantially-similar list. The practical consequence is that the provincial health act governs your client information and the federal act keeps applying to your practice as a commercial activity, rather than standing down the way it does in Ontario or Nova Scotia. Two regimes to know rather than one.

Manitoba publishes the clearest test of the three. Its act calls the responsible person a "trustee" — "a health professional, health care facility, public body, or health services agency that collects or maintains personal health information" (PHIA, s. 1(1)) — and the province answers the practical question directly. Health professionals are trustees if they are "self-employed (that is, in 'private practice') or in a partnership arrangement; or employed by a non-trustee" (Manitoba Health).

Saskatchewan uses "trustee" too, and its definition reaches "a person, other than an employee of a trustee, who is ... a health professional licensed or registered pursuant to an Act for which the minister is responsible" (HIPA, s. 2(1)(t)). Whether your own profession clears that bar is a question for the provincial commissioner rather than one to read off the wording — and worth knowing that the province states it "does not regulate therapists/counsellors" (Government of Saskatchewan).

Prince Edward Island uses "custodian", and its definition reaches "a health care provider, when not acting as an agent of a custodian" (Health Information Act, s. 1). The department's own worked example is a solo practitioner renting space: a chiropractor in private practice "is a custodian under the Act not the fitness facility" (PEI Health and Wellness).

For the territories, your own regulator and the federal commissioner are the places to ask.

Nova Scotia, New Brunswick, Newfoundland and Labrador

Each has a health-specific statute that the federal commissioner lists as substantially similar, so the vocabulary here is closer to Ontario's than it is in BC or Alberta. The obligations differ in the detail.

Nova Scotia's psychology regulator answers the custodian question directly, and the answer is the opposite of Alberta's: "those considered a 'Custodian' bear the primary responsibility for client records according to PHIA. ... An example of the 'Custodian,' according to PHIA, would be a psychologist who is operating a private practice, or it could be another healthcare professional operating a multidisciplinary practice" (NSRP, Use of Technology by Psychologists).

The same guidance carries the cross-border point, which matters if any of your software is hosted outside the country: for registrants in private practice, the provincial act "governs the handling of personal health information and continues to apply where that information is transferred for processing outside Canada; Custodians remain accountable for personal health information after it has been transferred."

Hold Nova Scotia and Alberta side by side for a moment. A psychologist in solo private practice is a custodian under the health act in one and is not in the other. There is no single Canadian pattern here to read across from.

Newfoundland and Labrador is the most explicit province in the country on this. Its act defines a custodian to include "a health care professional, when providing health care to an individual", and the list of governing statutes it works from names the Psychologists Act, 2005 and the Social Workers Association Act (PHIA, ss. 2 and 4). The provincial commissioner then says it in plain words — custodians include "regulated health professionals in private practice, such as doctors, dentists, pharmacists, physiotherapists, massage therapists, optometrists, occupational therapists, opticians, and psychologists" (NL OIPC).

New Brunswick reaches the self-employed practitioner by definition: its custodian definition includes "health care providers who are not agents or employees of a custodian" (PHIPAA, s. 1). Its regulation then designates social workers registered under the New Brunswick Association of Social Workers Act, 1988 as health care providers (N.B. Reg. 2010-112, s. 5). For other professions the published guidance is thinner — the province's own custodian fact sheet names "physicians, dentists and pharmacists" and stops there.

And a gap worth naming rather than papering over. For a registered counselling therapist in Nova Scotia, nothing published settles it either way. The custodian definition turns on being a "regulated health professional" licensed under an Act specific to the profession, counselling therapy is regulated under its own Act, and the province's list of regulated health professions includes counselling therapists — but no source draws the conclusion, and it is not one to assume from the psychology answer above. That is a call to your College, not a paragraph anyone should write for you.

What travels and what does not

Three things are worth internalising regardless of province.

The obligation to safeguard is universal. Every statute quoted here contains some version of it. The wording varies; the expectation does not.

Breach thresholds are where provinces diverge most. Quebec's "risk of serious injury," the federal "real risk of significant harm," and Ontario's prescribed circumstances are three different tests. Learn yours before you need it.

Your College's standard is a separate layer everywhere. It can require more than the statute, and it is the body most likely to be looking.

If you practise across provincial lines — clients in one province, office in another — the question of which law follows the client is a real one and not settled by intuition. Ask your College and your insurer, in that order.

About Rivet

Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.

One plan, $65 CAD a month, everything included. Fourteen-day trial, no card.

See what's included · Start the trial