Privacy & data residency

Two questions decide a practitioner’s privacy obligations, and neither is usually the one people ask. First: which statute actually governs you — which turns on how the legislation captures your profession, and that route is not the same for every discipline even inside one province. Second: what happens when client information leaves the province, whether through a hosted platform, a backup, or a colleague across a border.

The matrix below records both, per jurisdiction, with the operative provision quoted verbatim. Where an obligation is a strong reading of two provisions rather than something a source states outright, the row says that plainly rather than presenting inference as citation.

3 records traced and verified for Privacy, across 1 jurisdiction. Every row below carries its own source and last-verified date.

Privacy — obligations by jurisdiction and profession, each sourced to its primary text and dated to the last check against it.
Jurisdiction	Applies to	The rule	Status	Last verified	Source & citation
Ontario	Psychologist, Psychotherapist, Counselling therapist, Clinical social worker	Two different duties with two different triggers, and the asymmetry is the point. NOTICE TO THE INDIVIDUAL has NO threshold: on any theft, loss, or unauthorised use or disclosure of personal health information, notify the individual at the first reasonable opportunity and state in the notice that they may complain to the Commissioner (s. 12(2)). NOTICE TO THE IPC does have a threshold, set by O. Reg. 329/04 s. 6.3(1): theft is an automatic trigger, while other incidents run through a significance test weighing whether the information is sensitive, the volume involved, how many individuals are affected, and whether more than one custodian or agent was responsible. For a psychotherapy practice the sensitivity limb means even a single-client breach can clear that bar.	In Force	2026-07-31	Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, s. 12; s. 72 (offences) Show statutory text "(2) ... if personal health information about an individual that is in the custody or control of a health information custodian is stolen or lost or if it is used or disclosed without authority, the health information custodian shall, (a) notify the individual at the first reasonable opportunity of the theft or loss or of the unauthorized use or disclosure; and (b) include in the notice a statement that the individual is entitled to make a complaint to the Commissioner..." — PHIPA, s. 12(2) Regulatory model disclosure Authority basis privacy Enforcement body Information and Privacy Commissioner of Ontario Enactment date not traced Effective date not traced Penalties On conviction: a natural person is liable to a fine of not more than $200,000, imprisonment of not more than 1 year, or both; a non-natural person to a fine of not more than $1,000,000 (s. 72(2)). Most s. 72 offences require WILFUL conduct — ordinary negligence is not an offence, though it can still ground an IPC order. Prosecution requires the Attorney General's consent (s. 72(5)). Consent required No Documentation required Yes Confidence high Regulation O. Reg. 329/04, s. 6.3 Record ID ca-on-privacy-breach-notification
Ontario	Psychologist, Psychotherapist, Counselling therapist, Clinical social worker	An Ontario private-practice behavioural-health clinician is a health information custodian (HIC) under PHIPA, and therefore carries the Act's full duties — not PIPEDA, which is displaced for activity within Ontario. But the ROUTE into custodian status differs by profession, and the difference matters: psychologists and Registered Psychotherapists qualify under the 'health care practitioner' definition at s. 2(a), by virtue of being members of a college under the Regulated Health Professions Act, 1991. Clinical social workers qualify under a SEPARATE paragraph, s. 2(c), which exists precisely because OCSWSSW is not an RHPA college. A practitioner using an unregulated title is captured only by the residual clause s. 2(d) — 'any other person whose primary function is to provide health care for payment' — which turns on facts about their practice rather than a college registry check, and is a materially weaker footing.	In Force	2026-07-31	Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, ss. 2, 3(1) para. 1 Show statutory text "'health care practitioner' means, (a) a person who is a member within the meaning of the Regulated Health Professions Act, 1991 and who provides health care, (b) Repealed, (c) a person who is a member of the Ontario College of Social Workers and Social Service Workers and who provides health care, or (d) any other person whose primary function is to provide health care for payment;" — PHIPA, S.O. 2004, c. 3, Sched. A, s. 2 (e-Laws consolidation, currency date 2026-07-28) Regulatory model clinician_restriction Authority basis privacy Enforcement body Information and Privacy Commissioner of Ontario Enactment date not traced Effective date not traced Penalties — Consent required No Documentation required No Confidence high Record ID ca-on-privacy-custodian-status
Ontario	Psychologist, Psychotherapist, Counselling therapist, Clinical social worker	Using a US-hosted EHR, teletherapy platform, or cloud backup engages TWO regimes at once, and most practitioners know about neither. First, PHIPA s. 50(1) permits disclosure of PHI collected in Ontario to a person outside Ontario only on listed grounds — consent, statutory permission, reasonable necessity for the provision of health care, or payment/contractual administration. Ordinary EHR hosting is likely covered by the health-care-provision ground, but that is a ground the practitioner must be able to point to, not an automatic pass. Second, the federal order that exempts Ontario HICs from PIPEDA is scoped to activity 'within the Province of Ontario' — so PIPEDA re-attaches the moment personal health information crosses a provincial or national border. The practical effect: a solo Ontario practitioner on a US-hosted platform may have to satisfy PHIPA s. 50 and PIPEDA simultaneously for that same transfer.	In Force	2026-07-31	Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, s. 50(1) Show statutory text "Any health information custodian to which the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Schedule A, applies is exempt from the application of Part 1 of the Personal Information Protection and Electronic Documents Act in respect of the collection, use and disclosure of personal information that occurs within the Province of Ontario." — Health Information Custodians in the Province of Ontario Exemption Order, SOR/2005-399, P.C. 2005-2224, registered 2005-11-28 (emphasis on the territorial scope is ours; the words 'within the Province of Ontario' are the order's own) Regulatory model clinician_restriction Authority basis privacy Enforcement body Information and Privacy Commissioner of Ontario Enactment date not traced Effective date not traced Penalties — Consent required Yes Documentation required No Confidence high Regulation Health Information Custodians in the Province of Ontario Exemption Order, SOR/2005-399 Record ID ca-on-privacy-data-residency

Privacy — obligations by jurisdiction and profession, each sourced to its primary text and dated to the last check against it.

Jurisdiction

Applies to

The rule

Status

Last verified

Source & citation

Ontario

Psychologist, Psychotherapist, Counselling therapist, Clinical social worker

Two different duties with two different triggers, and the asymmetry is the point. NOTICE TO THE INDIVIDUAL has NO threshold: on any theft, loss, or unauthorised use or disclosure of personal health information, notify the individual at the first reasonable opportunity and state in the notice that they may complain to the Commissioner (s. 12(2)). NOTICE TO THE IPC does have a threshold, set by O. Reg. 329/04 s. 6.3(1): theft is an automatic trigger, while other incidents run through a significance test weighing whether the information is sensitive, the volume involved, how many individuals are affected, and whether more than one custodian or agent was responsible. For a psychotherapy practice the sensitivity limb means even a single-client breach can clear that bar.

In Force

2026-07-31

Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, s. 12; s. 72 (offences)

Show statutory text

"(2) ... if personal health information about an individual that is in the custody or control of a health information custodian is stolen or lost or if it is used or disclosed without authority, the health information custodian shall, (a) notify the individual at the first reasonable opportunity of the theft or loss or of the unauthorized use or disclosure; and (b) include in the notice a statement that the individual is entitled to make a complaint to the Commissioner..." — PHIPA, s. 12(2)

Regulatory model: disclosure
Authority basis: privacy
Enforcement body: Information and Privacy Commissioner of Ontario
Enactment date: not traced
Effective date: not traced
Penalties: On conviction: a natural person is liable to a fine of not more than $200,000, imprisonment of not more than 1 year, or both; a non-natural person to a fine of not more than $1,000,000 (s. 72(2)). Most s. 72 offences require WILFUL conduct — ordinary negligence is not an offence, though it can still ground an IPC order. Prosecution requires the Attorney General's consent (s. 72(5)).
Consent required: No
Documentation required: Yes
Confidence: high
Regulation: O. Reg. 329/04, s. 6.3
Record ID: ca-on-privacy-breach-notification

Ontario

Psychologist, Psychotherapist, Counselling therapist, Clinical social worker

An Ontario private-practice behavioural-health clinician is a health information custodian (HIC) under PHIPA, and therefore carries the Act's full duties — not PIPEDA, which is displaced for activity within Ontario. But the ROUTE into custodian status differs by profession, and the difference matters: psychologists and Registered Psychotherapists qualify under the 'health care practitioner' definition at s. 2(a), by virtue of being members of a college under the Regulated Health Professions Act, 1991. Clinical social workers qualify under a SEPARATE paragraph, s. 2(c), which exists precisely because OCSWSSW is not an RHPA college. A practitioner using an unregulated title is captured only by the residual clause s. 2(d) — 'any other person whose primary function is to provide health care for payment' — which turns on facts about their practice rather than a college registry check, and is a materially weaker footing.

In Force

2026-07-31

Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, ss. 2, 3(1) para. 1

Show statutory text

"'health care practitioner' means, (a) a person who is a member within the meaning of the Regulated Health Professions Act, 1991 and who provides health care, (b) Repealed, (c) a person who is a member of the Ontario College of Social Workers and Social Service Workers and who provides health care, or (d) any other person whose primary function is to provide health care for payment;" — PHIPA, S.O. 2004, c. 3, Sched. A, s. 2 (e-Laws consolidation, currency date 2026-07-28)

Regulatory model: clinician_restriction
Authority basis: privacy
Enforcement body: Information and Privacy Commissioner of Ontario
Enactment date: not traced
Effective date: not traced
Penalties: —
Consent required: No
Documentation required: No
Confidence: high
Record ID: ca-on-privacy-custodian-status

Ontario

Psychologist, Psychotherapist, Counselling therapist, Clinical social worker

Using a US-hosted EHR, teletherapy platform, or cloud backup engages TWO regimes at once, and most practitioners know about neither. First, PHIPA s. 50(1) permits disclosure of PHI collected in Ontario to a person outside Ontario only on listed grounds — consent, statutory permission, reasonable necessity for the provision of health care, or payment/contractual administration. Ordinary EHR hosting is likely covered by the health-care-provision ground, but that is a ground the practitioner must be able to point to, not an automatic pass. Second, the federal order that exempts Ontario HICs from PIPEDA is scoped to activity 'within the Province of Ontario' — so PIPEDA re-attaches the moment personal health information crosses a provincial or national border. The practical effect: a solo Ontario practitioner on a US-hosted platform may have to satisfy PHIPA s. 50 and PIPEDA simultaneously for that same transfer.

In Force

2026-07-31

Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, s. 50(1)

Show statutory text

"Any health information custodian to which the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Schedule A, applies is exempt from the application of Part 1 of the Personal Information Protection and Electronic Documents Act in respect of the collection, use and disclosure of personal information that occurs within the Province of Ontario." — Health Information Custodians in the Province of Ontario Exemption Order, SOR/2005-399, P.C. 2005-2224, registered 2005-11-28 (emphasis on the territorial scope is ours; the words 'within the Province of Ontario' are the order's own)

Regulatory model: clinician_restriction
Authority basis: privacy
Enforcement body: Information and Privacy Commissioner of Ontario
Enactment date: not traced
Effective date: not traced
Penalties: —
Consent required: Yes
Documentation required: No
Confidence: high
Regulation: Health Information Custodians in the Province of Ontario Exemption Order, SOR/2005-399
Record ID: ca-on-privacy-data-residency