Privacy — psychology, psychotherapy, counselling therapy and social work (Ontario)
Using a US-hosted EHR, teletherapy platform, or cloud backup engages TWO regimes at once, and most practitioners know about neither. First, PHIPA s. 50(1) permits disclosure of PHI collected in Ontario to a person outside Ontario only on listed grounds — consent, statutory permission, reasonable necessity for the provision of health care, or payment/contractual administration. Ordinary EHR hosting is likely covered by the health-care-provision ground, but that is a ground the practitioner must be able to point to, not an automatic pass. Second, the federal order that exempts Ontario HICs from PIPEDA is scoped to activity ‘within the Province of Ontario’ — so PIPEDA re-attaches the moment personal health information crosses a provincial or national border. The practical effect: a solo Ontario practitioner on a US-hosted platform may have to satisfy PHIPA s. 50 and PIPEDA simultaneously for that same transfer.
“Any health information custodian to which the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Schedule A, applies is exempt from the application of Part 1 of the Personal Information Protection and Electronic Documents Act in respect of the collection, use and disclosure of personal information that occurs within the Province of Ontario.” — Health Information Custodians in the Province of Ontario Exemption Order, SOR/2005-399, P.C. 2005-2224, registered 2005-11-28 (emphasis on the territorial scope is ours; the words ‘within the Province of Ontario’ are the order’s own)