What privacy rules apply to a wellness clinic?

Is my clinic a health information custodian?

Start here, because it decides which law applies. Under section 3 of PHIPA, a health information custodian includes a health care practitioner and a person who operates a group practice of health care practitioners, among others, when they have custody or control of personal health information because of their health care work.

In practice, if your clinic is run by members of a regulated health profession, it’s usually a custodian. Ontario regulates many professions under Schedule 1 of the Regulated Health Professions Act, 1991, including physiotherapy, massage therapy, chiropractic, naturopathy, psychotherapy, kinesiology, dietetics, and traditional Chinese medicine and acupuncture. Staff and contractors who handle information for the custodian are its agents, and the custodian stays responsible for them.

What if my wellness business isn’t a custodian?

Then PHIPA generally doesn’t govern you, and the federal PIPEDA generally does, because you collect personal information in the course of commercial activity. That often covers fitness studios, unregulated coaching and nutrition businesses, spas, retreats and wellness apps.

Health information is still sensitive under PIPEDA, so you’ll usually need express consent, strong safeguards and a clear privacy policy. The rules are different in detail, not lighter in practice.

What if we’re both?

Many businesses are. A clinic might employ regulated practitioners and also sell supplements, memberships or an app. The federal government has exempted Ontario custodians from PIPEDA for their collection, use and disclosure of personal health information within Ontario (SOR/2005-399), but the commercial side of the business can still fall under PIPEDA. Map which activities sit under which law before writing your forms.

What PHIPA requires of a custodian

A contact person and a public statement

A custodian that is a corporation or other organization must designate a contact person to handle privacy questions, access requests and complaints; a custodian who is an individual practitioner may designate one or perform those functions personally (section 15). It must also make available a written public statement describing its information practices, how to reach the contact person, how to request access or correction, and how to complain to the Information and Privacy Commissioner of Ontario (section 16). Many clinics post this on their website and at reception.

Consent

Under section 18, consent must be the individual’s own, be knowledgeable, relate to the information and not be obtained through deception or coercion. It can be express or, in some cases, implied. Within the “circle of care”, for providing health care, custodians can generally rely on assumed implied consent to share information with other custodians, unless the patient has said otherwise (section 20(2)). Disclosures outside that circle, such as to an employer or insurer, generally need express consent unless PHIPA allows them without consent.

Marketing and fundraising

Using personal health information for marketing or market research requires express consent (section 33). Fundraising has its own limits in section 32. Promotional emails to patients also need to meet CASL.

Access and correction

Patients have a right of access to their records, with limited exceptions. A custodian must generally respond within 30 days, which can be extended by up to another 30 days in some circumstances with written notice to the patient (section 54(2) to (4)). They can also ask for corrections.

Retention

PHIPA requires records to be retained, transferred and disposed of securely, but it doesn’t set a single retention period. Your regulatory college’s record-keeping standards usually do. Check your college’s current rules.

What happens after a privacy breach?

A custodian must notify the affected individual at the first reasonable opportunity if their information is stolen, lost, or used or disclosed without authority, and tell them they can complain to the IPC (section 12(2)). It must also notify the IPC in the circumstances set out in section 6.3 of O. Reg. 329/04, for example where information was stolen, a person who knew or ought to have known they had no authority used or disclosed it, the breach is part of a pattern, or it’s significant given its sensitivity and scale. Custodians must also file an annual report of the previous year’s breach statistics with the IPC on or before March 1 each year (section 6.4).

For non-custodians under PIPEDA, the test is whether a breach creates a real risk of significant harm; if so, you must report it to the federal Privacy Commissioner and notify the people affected. See breach of security safeguards.

What are the penalties?

PHIPA offences can lead to fines of up to $200,000 for individuals, who can also face up to one year in prison, and up to $1,000,000 for organizations (section 72). Since January 1, 2024, the IPC can also impose administrative monetary penalties, according to the IPC’s guidance. Under section 35 of O. Reg. 329/04, a penalty can’t exceed $50,000 for an individual or $500,000 for an organization, though the IPC can add the economic benefit gained from the contravention. Regulated professionals may also face college discipline.

Software, virtual care and AI tools

Most clinics rely on vendors for booking, charting, payments and virtual care. Before you sign:

• confirm where the data is stored and who at the vendor can access it;
• get a written agreement limiting the vendor to providing the service, with security and breach notice terms (see data processing agreement);
• check whether the vendor uses your patients’ data for its own purposes, such as training AI models;
• confirm how you’ll get the records back if you switch.

PHIPA’s regulation also places obligations on electronic service providers to custodians. For AI scribes that record visits and draft notes, the IPC has published an AI scribes checklist covering consent, vendor assessment and retention. See also terms for AI products if you’re building such a tool.

Intake and consent forms

Your privacy policy and your consent forms do different jobs. The policy or public statement explains your practices to everyone. Intake and consent forms record what each client agreed to: what you’ll collect, who you may share it with, whether you’ll contact them by email or text, and whether they agree to things like photos, recordings or AI note-taking.

What to do next

1. Decide whether each part of your business is a custodian under PHIPA, or covered by PIPEDA.
2. Name a privacy contact and publish a public statement or privacy policy.
3. Update intake and consent forms to match what you actually do.
4. Review vendor agreements for storage, access, AI use and breach notice.
5. Write a short breach response plan and diary the IPC’s March 1 annual report if you’re a custodian.

Our clinic privacy and consent work covers your privacy policy, client intake and consent forms, and a review against PHIPA where it applies, at a fixed fee shown on our fees page. See also health privacy and consent.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To talk through your clinic or wellness business, book a free 15-minute consult.