iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
HIPAA is not automatically required just because a Canadian therapist sends therapy messages electronically. The U.S. law applies when the therapist or messaging provider is a HIPAA covered entity or business associate, usually because it provides services for a U.S. covered organization and handles protected health information (PHI). Canadian privacy law applies independently and is usually the first framework a Canadian practice must assess.
The correct answer depends on the province or territory, whether the practice is private or connected to a health organization, who controls the messages, any payer or referral relationship, and where the messaging service and its subcontractors process information. This is a general technology and privacy explainer, not a legal determination for a particular practice.
What HIPAA actually regulates
HIPAA is a U.S. federal framework with a defined legal scope. The U.S. Department of Health and Human Services (HHS) states that its Privacy, Security, Breach Notification and related Rules apply to covered entities and business associates. The fact that a message contains health information, or that an application advertises itself as secure, does not by itself bring every user under HIPAA.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteCovered entities
Covered entities include health plans, health-care clearinghouses and certain health-care providers that conduct specified electronic transactions. A Canadian therapist is not automatically a covered entity merely because the therapist provides health care or communicates with clients online. The practice’s legal structure, transactions and relationships have to be examined.
#1 Best Overall
Business associates
A business associate is an organization that performs certain functions or services for a covered entity and, in doing so, creates, receives, maintains or transmits PHI. HHS gives a patient-messaging application developer contracted by a covered entity to provide patient-management services, such as messaging, as an example of a possible business associate.
A Canadian therapist could therefore face a HIPAA issue when acting for a U.S. hospital, insurer, clinic or other covered entity, or when a Canadian company supplies a service on that organization’s behalf. The relevant question is the relationship and data flow, not the therapist’s nationality or the location of a phone.
When HIPAA may not apply
HHS says an organization that meets neither the covered-entity nor business-associate definition does not have to comply with the HIPAA Rules. A therapist operating an independent Canadian practice for Canadian clients may fall outside HIPAA, even though the practice still has substantial duties under Canadian privacy and professional rules.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Canadian privacy law is a separate starting point
Canadian rules do not disappear when HIPAA is absent. The Office of the Privacy Commissioner of Canada (OPC) identifies medical records and other health details as personal information. A private-sector practice handling client information in commercial activity generally has to assess the federal Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial legislation, professional requirements and contractual duties.
PIPEDA and cross-border activity
PIPEDA applies to private-sector commercial handling of personal information across Canada. It also continues to apply to commercial information flows that cross provincial or national borders. A practice can therefore have PIPEDA obligations when a messaging provider stores, supports or accesses information outside the province or outside Canada, even if the therapist and client are both Canadian.
PIPEDA is organized around 10 fair-information principles, including accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access and challenging compliance. The principles are operational requirements, not a certification that a particular app can obtain for a practice.
Substantially similar provincial laws
Alberta, British Columbia and Quebec have private-sector privacy statutes recognized as substantially similar to PIPEDA for covered in-province activity. Organizations are generally exempt from PIPEDA for handling governed entirely by those provincial laws, but PIPEDA can still apply to interprovincial or international commercial flows.
Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have substantially similar laws for personal health information. Other provinces and territories have their own combinations of health-information statutes, privacy laws and professional standards. The governing rule can change with the practice’s location, the client’s location, the type of organization involved and the direction of the data flow.
Rank #3
Ontario virtual-care example
Ontario’s Information and Privacy Commissioner stated in Privacy and security considerations for virtual health care visits (February 2021): “Ontario’s health privacy law, the Personal Health Information Protection Act (PHIPA), applies to virtual care as it does to in-person care.” The commissioner’s guidance includes secure messaging within the broad concept of virtual care. That does not make PHIPA the rule everywhere in Canada; it illustrates why local law must be checked rather than inferred from HIPAA terminology.
Why a messaging app creates privacy obligations
Therapy messages can contain diagnoses, symptoms, medications, appointment details, crisis disclosures, payment information, attachments and identifying metadata. Notifications may display text on a locked screen; backups may be stored separately; support personnel or subcontractors may have technical access; and an artificial-intelligence feature may process content for a purpose unrelated to care.
The OPC says an organization remains responsible for personal information under its control when a third party processes it. The practice cannot transfer accountability simply by clicking “accept” on a software subscription. It must use contractual or other means to obtain comparable protection and must be able to explain how the service fits its legal and professional duties.
Recommended Free Tools
How to review a therapy-messaging provider
Complete the review before enabling client messaging. The following sequence follows the OPC’s guidance on assessing third-party service providers and adapts it to therapy records.
Rank #4
- Map the information. List message text, photographs, documents, voice notes, appointment reminders, push-notification previews, contact details, timestamps, IP addresses, audit logs, backups and support tickets. Mark which fields are especially sensitive.
- Identify every participant. Record the therapist, reception staff, supervisors, contractors, the vendor, hosting companies, analytics providers, customer-support personnel and every subcontractor that can access or process the information.
- Locate processing and storage. Ask where primary data, backups, disaster-recovery copies and support access are located. Record the countries and provinces involved, the legal entities responsible and whether locations can change without notice.
- Document purposes and secondary use. Determine whether the provider uses message content, attachments or metadata for service delivery, analytics, product improvement, advertising, algorithm training or any other purpose of its own. A statement that data is “encrypted” does not answer this question.
- Examine safeguards. Obtain details on encryption in transit and at rest, account authentication, role-based access, administrator controls, audit logs, device sessions, vulnerability management, employee training and incident monitoring. Match controls to the sensitivity of therapy records.
- Negotiate the agreement. Specify permitted processing, confidentiality, subcontractor approval, security standards, retention, export, deletion, assistance with access requests, audit information and breach-notification timelines. If a U.S. covered entity is involved, determine whether a HIPAA business-associate agreement is required.
- Plan the end of the relationship. Confirm how records will be exported in a usable format, how production systems and backups will be deleted, what evidence of deletion is supplied and which obligations survive termination.
- Reassess periodically. Review material product, ownership, subcontractor, processing-location and artificial-intelligence changes. Keep a record of the assessment and the decision to continue, restrict or stop using the service.
Questions a provider should answer
- What client information appears in messages, attachments, notifications and audit logs?
- Who can view it, under what role, and how is access logged?
- Where is it stored, backed up and accessed from?
- Which subcontractors participate, and can the practice object to a new one?
- Does the provider use content or metadata for analytics, advertising, product improvement or AI training?
- What retention, export and deletion controls are available to the practice?
- How quickly will the provider notify the practice of a suspected or confirmed breach?
- Can the service support provincial recordkeeping, client-access and correction duties?
Consent, notice and client expectations
Consent is part of the analysis, not a substitute for it. The OPC says express consent is generally appropriate when information is sensitive, a use or disclosure falls outside reasonable expectations, or a meaningful residual risk of significant harm remains. Therapy information is highly sensitive, so a practice should assess whether express consent is needed for the selected channel and its particular uses.
A client-facing notice should explain the channel’s purpose, who may see messages, whether notifications can appear on a shared device, expected response times, emergency limitations, retention, the provider’s processing locations and available alternatives. Tell clients how to revoke or change their communication preference where the law permits. Consent does not remove the practice’s independent duties for accountability, safeguards, access, retention or breach response.
Operational controls for a small practice
Even when HIPAA does not apply, ordinary implementation choices can reduce risk:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Use individual staff accounts rather than shared logins and remove access promptly when a role changes.
- Require strong, unique passwords and multifactor authentication where the service supports it.
- Disable message previews on lock screens and shared workstations.
- Separate clinical records from informal chat when the platform does not provide reliable export and retention controls.
- Set a documented response-time policy and tell clients that messaging is not monitored continuously.
- Define an emergency route, such as local emergency services or a crisis line, instead of asking clients to rely on asynchronous messages.
- Train staff not to forward therapy content to personal accounts or unapproved applications.
- Test account recovery, export and deletion procedures before a client depends on the service.
- Maintain an incident log and a written breach-assessment process that covers the vendor as well as the practice.
Common assumptions that lead practices astray
“A Canadian therapist never needs to think about HIPAA.”
That is too broad. HIPAA can become relevant when the therapist or a technology provider performs services for a U.S. covered entity and handles PHI. The relationship must be analyzed even if the work occurs from Canada.
Best Value
“A HIPAA-compliant badge proves the app is lawful in Canada.”
It does not. A vendor’s HIPAA claims address, at most, a U.S. legal framework and the vendor’s stated controls. They do not determine whether PIPEDA, a provincial health-information law, a professional regulator or a contract permits the proposed processing.
“Canadian hosting is mandatory, so choosing a Canadian data centre solves the problem.”
The cited OPC guidance calls for understanding processing jurisdictions and obligations; it does not establish a universal Canadian-storage requirement or say that location alone is sufficient. A Canadian-hosted service can still have foreign support access, subcontractors, inadequate safeguards or impermissible secondary uses.
“Encryption makes the service compliant.”
Encryption is a safeguard, not a complete compliance assessment. Access controls, identity management, metadata, backups, retention, deletion, breach response, contractual limits and the provider’s own purposes remain relevant.
“A client’s signature waives the practice’s responsibility.”
Consent can authorize a defined collection, use or disclosure when validly obtained, but it does not erase accountability, security or other statutory duties. The practice still has to choose and supervise an appropriate service.
A practical decision framework
| Situation | HIPAA question | Canadian question | Practical action |
|---|---|---|---|
| Independent Canadian practice serving Canadian clients | Does the practice meet a covered-entity definition or act for one? Often no, but verify the facts. | Which federal, provincial health-information, privacy and professional rules govern the practice and the data flow? | Start with provincial law and a full vendor assessment; do not rely on a HIPAA label. |
| Canadian therapist contracted by a U.S. covered organization | Is the therapist a business associate or subcontractor handling PHI? Obtain the covered organization’s determination and required agreement. | Which Canadian rules still apply to the therapist, staff and service providers? | Coordinate the HIPAA contract with Canadian obligations, security controls and recordkeeping. |
| Messaging vendor serving a U.S. covered entity | Does the vendor perform a covered function involving PHI? A patient-messaging service can be a business associate. | What Canadian obligations apply to the practice, Canadian clients and cross-border processing? | Review the business-associate terms and the Canadian privacy impact of the complete data flow. |
| Vendor offers optional analytics or AI training | Is the secondary use permitted for PHI under the covered entity’s arrangements? | Is the purpose reasonable, disclosed and consented to where required, and are safeguards and contracts adequate? | Disable or prohibit secondary use unless the practice can justify and document it. |
When to obtain specialized advice
Get advice from a Canadian privacy lawyer or qualified privacy professional when the practice serves multiple provinces, handles records for a hospital or insurer, sends information outside Canada, uses a vendor that trains models on content, receives U.S. referrals or payments, or cannot determine who controls the record. Ask the adviser to review the actual contract, privacy notice, data-flow diagram and provincial requirements rather than answering only whether an app is “HIPAA compliant.”
The defensible approach is to treat HIPAA as a relationship-based U.S. question and Canadian privacy as an independent, ongoing obligation. A messaging service is suitable only when its data practices, safeguards, contract, consent process and recordkeeping fit every rule that applies to the practice’s actual operations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
