What is PHIPA and how does it protect virtual therapy records in Ontario?

PHIPA is Ontario's law governing your health information

The Personal Health Information Protection Act, 2004, known as PHIPA, is Ontario's provincial law setting the rules for how health information custodians, including therapists and other regulated health professionals, collect, use, store, and share personal health information. Therapy and coaching session notes, intake forms, and any records your provider keeps about your care all fall under PHIPA's definition of personal health information.

PHIPA sets out consent requirements before information is shared, limits on who can access it, and obligations to keep it secure, whether the record is on paper or in a digital system.

The law applies to a wide range of health information custodians, not just hospitals and family doctors. Regulated professionals such as Registered Social Workers delivering therapy or coaching fall within its scope whenever they are providing health care, which is the basis for the privacy protections attached to your sessions.

It applies to virtual care exactly the same as in-person care

Ontario's Information and Privacy Commissioner has confirmed directly that PHIPA applies to virtual health care visits in the same way it applies to in-person visits. Moving a session from an office to a video call does not lower the privacy bar or create a gap in the law. The same consent rules, security expectations, and patient rights carry over.

The IPC's guidance on privacy and security for virtual health care visits sets out practical expectations for providers, including using platforms with appropriate safeguards, being thoughtful about where and how a session is conducted, and being transparent with patients about how their information is handled during virtual care.

That guidance also touches on your side of the call: taking a session somewhere private, using headphones where possible, and knowing who else in your household might be able to overhear are practical steps that support the same privacy protections PHIPA sets out, even though they are not legal requirements imposed on you.

PHIPA gives you specific, enforceable rights over your records

As a patient, PHIPA is not just a rule for providers to follow quietly. It gives you rights you can act on.

• The right to access your own personal health information, with limited exceptions
• The right to request a correction if you believe your record is inaccurate or incomplete
• The right to know, in general terms, how your information may be used and disclosed
• The right to complain to the Information and Privacy Commissioner of Ontario if you believe your privacy rights were violated

Your provider's own college adds a confidentiality layer on top of PHIPA

If your therapist is a Registered Social Worker, the Ontario College of Social Workers and Social Service Workers' Code of Ethics and Standards of Practice sets out its own principles on confidentiality and record-keeping, covering how records are created, stored, and eventually retained or destroyed, on top of what PHIPA requires. In practice, this means your therapist is answerable to both provincial privacy law and their professional college for how your information is handled.

This double layer matters in practice because it gives you two separate avenues if something goes wrong: a complaint to the Information and Privacy Commissioner of Ontario over a privacy breach, or a complaint to the relevant college over a professional standards issue, depending on what happened.

What a PHIPA-compliant virtual therapy practice looks like in practice

You do not need to audit your therapist's IT systems, but a few signs suggest privacy is being taken seriously. Finding Focus's therapy program, for example, is delivered by a Registered Social Worker who is bound by both PHIPA and OCSWSSW's standards for every session, whether by video or phone.

• A clear explanation of consent before your first session begins
• A private, secure platform rather than an unsecured public video tool
• A stated policy on who can access your notes and under what circumstances
• A way to formally request access to, or correction of, your own records