A communications consent is short — most are half a page — and its job is narrow: to make sure the client knows what each channel is for, what its risks are, and what happens to what they send. Anything longer usually goes unread, which defeats the purpose.

The most complete published checklist for this comes from Ontario's psychotherapy College, which lists what a registrant should address in an electronic-practice agreement. Its items, verbatim:

• "The particular technology or platform that will be used"

• "Risks or benefits associated with the technology, including the limitations of the technology"

• "Steps to be taken in the event of a technology disruption or when a client is in crisis"

• "Therapist's responsibility to maintain confidentiality, and measures that are employed to preserve confidentiality, and limitations to confidentiality"

• "Measures a client can employ to protect their privacy and personal health information"

• "Practice policies relevant to electronic practice (e.g. payment methods, appointment cancellations, disruption in services)"

• "The therapist's usual hours of work and average response times to between-session communications from clients"

• "That the registrant is a regulated health professional in Ontario, and that CRPO is the organization that sets the rules for and considers complaints about registered psychotherapists"

(CRPO Electronic Practice Guideline)

That list is a guideline rather than a standard, and the College is careful about the difference: registrants "must rely on their knowledge, skill, and judgment to determine when it is appropriate to apply a particular guideline." It also says these publications "may be used by the College or other bodies in determining whether appropriate standards of practice and professional responsibilities have been maintained" — so it is not a rule, and it is not nothing.

That is the skeleton. What follows is what practitioners find themselves adding because leaving it out caused a conversation.

What the channel is for — and what it is not for

The privacy commissioner's email guidance describes the narrow-channel pattern directly: "custodians may limit the use of unencrypted email to the scheduling of appointments only and have a policy of not sending or receiving any clinical information via unencrypted email" (IPC).

Naming the limit is what makes the limit real. A form that says "we may communicate electronically" has consented the client to everything and told them nothing.

That the channel is not secure

The commissioner's guidance is built around the assumption that the consent "should be in plain language and indicate the types of information that may or may not be communicated by unencrypted email, the risks of using unencrypted email and the circumstances where the custodian will use unencrypted email."

The Ontario social work standards make the same point from the professional direction, and put it early: "College registrants shall inform clients early in their relationship of the limits of confidentiality of information" (OCSWSSW 5.1.3).

One sentence covers it. Something like: messages sent by text or ordinary email can be seen by other people if a device is lost or an account is compromised, and neither is a private channel in the way a session is.

Response times, said in a number

This is the item that prevents the most harm, and it is on the College's list for a reason. "The therapist's usual hours of work and average response times to between-session communications from clients."

A client who knows you check messages on weekday mornings will not spiral at 10pm. A client who does not know will.

What to do instead in a crisis

Also on the College's list — "steps to be taken in the event of a technology disruption or when a client is in crisis."

Name the alternative concretely rather than saying "seek help elsewhere." In Canada that generally means 9-1-1 for immediate danger, and 9-8-8, the Suicide Crisis Helpline — which takes both calls and texts, is available 24 hours a day, seven days a week, and is open to anyone in Canada (Government of Canada). Add whatever local service you would actually want someone to reach.

Check anything you name still exists and still runs the hours you think it does before you print the form, and again when you reprint it. Services close, hours change, and a consent form outlives the season it was written in.

The consent form is one of the few documents a client keeps, which makes it an unusually good place for this to live.

That messages form part of the record

The item most often left out, and the one most likely to cause the scene described in the Ontario social work practice notes, where a client discovers after the fact that his email "is part of the client's clinical record" and the relationship does not survive it.

The College's guideline puts the disclosure obligation in terms of what clients want to know: "clients may be interested to know whether email communications are stored separately or in the clinical record, or whether sessions can be recorded" (CRPO Electronic Practice Guideline).

How to withdraw consent

Not always required in the published lists, but it is the fastest way to demonstrate that the consent is real. One sentence: tell me and we will stop using it, and here is what we will use instead.

Where consent forms go wrong

Three failure modes, all of them familiar.

It describes an ideal practice rather than yours. A form promising 24-hour responses from someone who answers twice a week is worse than no form.

It is signed once and never revisited. When the channel's use changes — and it does — the consent has to catch up.

It is written in the register of a terms-of-service document. The client is consenting to something clinical. It should sound like you.

Whether yours needs to be in writing

The psychotherapy standard requires a contract before providing services by communications technology, and the College's guideline notes that while "the Standard does not specify that this contract must be in writing, registrants are encouraged to establish a written agreement," and where there is no written contract, the discussion "must be documented in the clinical record."

For other professions and other provinces the requirement differs, and one of them turns the list above into a published minimum rather than a suggestion.

The CCPA standards — which the Nova Scotia College of Counselling Therapists publishes as its own — require a written policy and then say what it has to convey: "in what instances these communications will be used (e.g., scheduling versus therapy)"; "what technologies will be used (text, email, other online messages apps)"; "any risks to privacy/confidentially associated with the particular technology being used"; and "anticipated response times" (CCPA Standards of Practice).

Four items, and three of them are already above. The fourth — response times — is the one that gets left off most often.

The same standards add a line practitioners rarely think to include: if a client declines a channel, offer another. "if a client were to decline using email for correspondence, then telephone should be offered as an alternative."

Where a form is not required, a record still is. Ontario social work asks only that the consent be captured — "Clients may sign consent forms or provide verbal consent; College registrants shall document that consent was obtained" (OCSWSSW 5.2.1). Ontario psychology prefers written consent, "physical or via secure technology", but accepts oral consent that is "documented in the client's file" (CPBAO Standard 7.1(c)).

About Rivet

Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.

One plan, $65 CAD a month, everything included. Fourteen-day trial, no card.

See what's included · Start the trial