Therapy clinic compliance in Canada: rules by province

Therapy clinic regulations in Canada: three layers of rules

Therapy clinic regulations in Canada come from three places at once. Federal law matters for privacy, email marketing, tax and advertising. Provincial and territorial law covers health privacy, children, employers and safety. And each clinician answers to a regulator whose practice standards often matter most for records, fees and advertising. Those standards differ by profession, even inside one province.

The table shows six examples, each from an official page we read. They are examples of difference, not a complete list of rules.

• Federal layer: PIPEDA where no provincial law displaces it, the federal anti-spam law (CASL), Canada Revenue Agency tax rules and the Competition Act on advertising. We found no federal licence for a private clinic; the federal page sets out what each source says.
• Provincial or territorial layer: a health information Act or a private-sector privacy law, child-protection reporting duties, employment standards, occupational safety and workers’ compensation. Each province has its own page, and the three territories share one.
• Clinician regulator layer: the standards of the college, regulator or funder that governs each profession in the building. Check each clinician’s own regulator. These pages do not state that one regulator’s rule is the rule for a whole clinic.

Therapy clinic compliance by jurisdiction: main privacy law

The table names the main privacy law for a private therapy clinic in each jurisdiction and links to it. The page for each jurisdiction explains who counts as a custodian or trustee, what a breach triggers, which regulators matter for each profession and what applies to the clinic as a business and employer.

Where the table says the OPC list does not name a law, that is a statement about one OPC page. The OPC says the question of which privacy law applies is decided case by case, so ask the privacy commissioner or a lawyer about your clinic.

Six comparison tables for therapy clinic regulations

Six topics recur across the provinces and territories, and a clinic with several professions needs them side by side. Each table page compares the jurisdictions side by side and links each rule to the official text where we found one. Where two official sources disagree, the page shows both links and does not choose between them.

• Record retention by province: how long each regulator or privacy law says to keep client records, and when the clock starts for a child. The BC regulator CHCPBC, for example, sets at least 16 years from the last encounter or from the age of majority, whichever is later [HUB-1].
• Privacy breach reporting by province: whether a statute names a regulator to tell. Federal regulations require a record of every breach of security safeguards to be kept for 24 months [HUB-2]. BC’s commissioner guide says organizations can report breaches to the commissioner [HUB-3], and Saskatchewan’s commissioner describes reporting as not mandatory for trustees [HUB-4].
• Child-abuse reporting and minor consent: the duty falls on any person who has the information, and the age line differs. Yukon’s government page refers to a child or youth under 19 [HUB-5]; the Northwest Territories’ Act defines a child as under 16 [HUB-6]; Nunavut’s Family Services sheet describes a child as 0 to 16 years of age [HUB-7].
• Criminal record checks for therapy staff: the RCMP says no federal legislation requires any organization to conduct vulnerable sector checks [HUB-8]. Some funders and regulators ask for them, for example the OAP Provider List at its three-year renewal [HUB-9] and the Northwest Territories psychologist application [HUB-10].
• Therapy receipt and fee rules: what each regulator, funder or insurer says an invoice, receipt or cancellation charge must show.
• Reviews and testimonials rules: Ontario’s speech-language pathology and physiotherapy regulators differ, as the first table on this page shows, and the Competition Bureau’s digest describes fake and incentivized reviews as a misleading-advertising issue [HUB-11].

Dated changes for therapy clinics in Canada

Every date below is absolute and comes from the official page named in the last column, which we read on 2026-10-08. Re-open the source in the week before a date, because governments revise these pages.

The federal items without a fixed date are proposals, not law. Bill C-36 (an act to enact the Protecting Privacy and Consumer Data Act and amend PIPEDA) was introduced and read a first time on 15 June 2026, and LEGISinfo lists it at second reading in the House of Commons [HUB-12]. Finance Canada’s July 2026 explanatory notes propose changes to who can certify the disability tax credit, for certificates issued after 2026 [HUB-13].

How to use these therapy clinic compliance pages

The pages are built to be checked, not trusted. Use them to find the official source quickly, then read the source.

• List every profession in the building, such as speech-language pathology, occupational therapy, physiotherapy, psychology, behaviour analysis and assistants, and open each clinician’s own regulator or funder for your province.
• Read your province or territory page for health privacy, working with children, running the clinic as a business and employer, and funding programs. Then read the federal page.
• Use the six tables when one policy must cover several professions. Read the rows for every clinician before writing the clinic’s policy, and ask each regulator how its rule applies to work done in a shared clinic.
• Where two official sources disagree, a page shows both links and says so. It does not pick one.
• Where a cell says “not found on the official pages we read”, we looked and found nothing. That does not mean no rule exists. Ask the regulator.
• Check the Last checked date on each page and the date on the source itself, and re-check before acting, especially around the dates in the calendar above.

Where TherapyCRM fits next to these rules

TherapyCRM is practice management software with a clinical record for English-language clinics in Canada outside Quebec. It is not a physician EMR. Nothing on these pages says that TherapyCRM meets any rule listed here, and a clinic remains responsible for its own policies, its regulators’ standards and its legal advice.

TherapyCRM’s funding tracking is built around the Ontario Autism Program; it does not support the other funding programs named on these pages.

Frequently asked questions