PIPEDA for therapy clinics in Canada: privacy, CASL and tax rules

What the federal layer covers for therapy clinics

Federal rules reach a private therapy clinic in a handful of places. The table gives one sentence for each, with the official page behind it. The sections below add the detail and the dates. Provincial and territorial rules, and each clinician’s regulator, sit on the jurisdiction pages.

Where PIPEDA applies to therapy clinics

PIPEDA Part 1 applies to every organization for personal information it collects, uses or discloses in the course of commercial activities (section 4(1)). Under section 26(2)(b), the Governor in Council may exempt an organization or activity from Part 1 where a substantially similar provincial law applies, in respect of collection, use or disclosure that occurs within that province [FED-1].

The OPC page “Provincial laws that may apply instead of PIPEDA” names the private-sector laws of Alberta and British Columbia (and Quebec, which these pages do not cover), and four provincial health information laws, as substantially similar. It says organizations subject to such a law are generally exempt from PIPEDA for collection, use or disclosure within that province, and that PIPEDA still applies to transactions involving personal information transferred across borders [FED-2].

The OPC says that when more than one privacy law could apply to an organization, it must comply with both, and that determining which law applies must be done case by case [FED-2]. The page does not name Manitoba’s, Saskatchewan’s or Prince Edward Island’s health information law, and it does not say whether PIPEDA also reaches a fee-for-service clinic in those provinces. Ask the provincial privacy commissioner or a lawyer.

The OPC says organizations in the Northwest Territories, Yukon and Nunavut are considered federally regulated and are covered by PIPEDA [FED-2, FED-3].

For Ontario, a federal order exempts any health information custodian to which the Personal Health Information Protection Act, 2004 applies from Part 1 of PIPEDA in respect of the collection, use and disclosure of personal information that occurs within Ontario [FED-4].

PIPEDA breach records, reporting and consent

The duties below apply to an organization that PIPEDA covers. Where a provincial health law applies instead, use the jurisdiction page and the breach reporting table.

• Reporting: under section 10.1, an organization must report to the Privacy Commissioner a breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe the breach creates a real risk of significant harm to an individual, and must make the report as soon as feasible after it determines the breach occurred. It must also notify the affected individual [FED-1].
• Records: section 10.3 requires a record of every breach of security safeguards, whether or not it must be reported. The regulations set the period at 24 months after the day the organization determines the breach occurred, and the record must contain any information that enables the Commissioner to verify compliance with the reporting and notification duties [FED-5].
• Report contents: the regulations require a written report that describes the circumstances and, if known, the cause, the day or period of the breach, the personal information involved, the number of people affected and the steps taken to reduce the risk of harm [FED-5].
• Notice to individuals: direct notification may be given in person, by telephone, mail, email or any other form of communication a reasonable person would consider appropriate in the circumstances [FED-5].
• Assessing harm: OPC guidance says the assessment looks at the sensitivity of the information and the probability of misuse, and says health and financial information will generally be considered sensitive. The OPC publishes a breach report form on its site [FED-6, FED-7].
• Offence: an organization that knowingly contravenes section 10.1 or section 10.3(1) is guilty of an offence liable to a fine of up to $10,000 on summary conviction or up to $100,000 on indictment (section 28) [FED-1].
• Consent: OPC guidelines say organizations should generally obtain explicit consent when information is sensitive. They also say to obtain consent from a parent or guardian for anyone unable to give meaningful consent, which the OPC takes to mean anyone under 13 in all but exceptional circumstances, and to consider the maturity of youth who can consent themselves [FED-8].
• Draft guidance on third-party providers: the OPC is accepting comments until 4 December 2026 on draft guidance for assessing third-party service providers. It says an organization is responsible for personal information handled on its behalf, and it describes using contractual or other means to ensure comparable protection [FED-9].

CASL email rules for therapy clinics

Canada’s anti-spam law (CASL) matters to a clinic that emails or texts families about services. This section paraphrases the Act and two federal guidance pages. Whether a particular message is a commercial electronic message is a question for a lawyer.

• What counts: a commercial electronic message is a message that, having regard to its content, hyperlinks or contact information, it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity (section 1(2)) [FED-10].
• The rule: section 6(1) prohibits sending a commercial electronic message unless the recipient has consented, expressly or impliedly, and the message complies with section 6(2). Section 6(2) requires information that identifies the sender and anyone on whose behalf it is sent, contact information, and an unsubscribe mechanism [FED-10].
• Unsubscribe requests: the sender must give effect to an unsubscribe request without delay, and no later than 10 business days after it was sent (section 11(3)) [FED-10].
• Exceptions to the consent requirement: section 6(6) says the consent requirement in section 6(1)(a) does not apply to a message that solely provides a quote or estimate the recipient requested, or that facilitates, completes or confirms a commercial transaction the recipient previously agreed to, among other cases. The identification and unsubscribe content in section 6(2) is a separate requirement [FED-10].
• Implied consent: section 10(9) and (10) recognize an existing business relationship, which includes a purchase of a service within the two years before the message was sent and an inquiry or application within the six months before it [FED-10]. The federal guidance page says senders should be ready to provide proof of consent if asked [FED-11].
• Appointment reminders: we did not find an official page that says whether an appointment reminder is a commercial electronic message. Ask the CRTC or a lawyer about a message that mixes a reminder with promotion.
• Penalties: the maximum penalty for a violation is $1,000,000 for an individual and $10,000,000 for any other person (section 20(4)) [FED-10].
• Enforcement: the Competition Bureau’s FAQ says it investigates false or misleading representations and deceptive marketing practices in the electronic marketplace [FED-12].

GST/HST on therapy services

This section paraphrases the Excise Tax Act and CRA publications. It is not tax advice. Whether a particular supply is exempt is a question for an accountant or the CRA.

Part II of Schedule V to the Excise Tax Act (Exempt Supplies) lists a supply of physiotherapy services, speech-language pathology services, occupational therapy services, psychological services, psychotherapy services and counselling therapy services if the service is rendered to an individual by a practitioner of the service (section 7). The Act defines a practitioner as a person who practises the profession and, where a licence or certification is required in the province where the service is supplied, holds it, or, where none is required there, has qualifications equivalent to those needed in another province (section 1). The service must also be a qualifying health care supply, such as one made to maintain health, prevent disease or treat, relieve or remediate an injury, illness, disorder or disability (sections 1 and 1.2) [FED-13].

Section 7.4 of Part II covers a service where all or substantially all of the consideration is reasonably attributable to two or more particular services, each of which would be included in sections 5 to 7.3 if supplied separately [FED-13].

• GI-113, condition 1: the training is specially designed to help the individual cope with, or alleviate or eliminate, the effects of autism. It does not have to be given by a doctor, psychologist or other health care professional [FED-14].
• GI-113, condition 2: the training is given to the individual with autism, or to a person who provides personal care or supervision to that individual otherwise than in a professional capacity, such as a parent or caregiver [FED-14].
• GI-113, condition 3: one of four things applies. A practitioner such as a provincially licensed psychologist, doctor, social worker or registered nurse certifies in writing that the training is appropriate, and is not the person giving it; or a government supplies the training; or the supplier is paid by a government, or by an organization administering a government autism program, to give it; or the person acquiring it is paid by such a source to acquire it. A partial subsidy is enough for the last two [FED-14].
• We do not say how these conditions apply to a particular clinic’s ABA services. Ask an accountant or the CRA.

Medical expense tax credit: practitioners the CRA lists

The CRA publishes a table of the health care professionals it recognizes as authorized medical practitioners for the medical expense tax credit, with a column for each province and territory. The page was last modified on 2026-01-22 [FED-16].

The table shows “Yes” or “not applicable” in each column but does not define “not applicable”. The CRA page lists the behaviour analyst entry for Ontario as taking effect on 1 July 2024 [FED-16]. Ask the CRA about how the table applies to a particular fee.

Disability tax credit: who can certify form T2201

Form T2201 (version 23, the version the CRA form page lists) names the practitioners who may complete each impairment section of Part B. A behaviour analyst does not appear in those lists. The form says an occupational therapist can only certify limitations for walking, feeding and dressing, including in the cumulative effect section [FED-17].

Finance Canada’s July 2026 explanatory notes describe proposals, not law. They would let speech-language pathologists also certify feeding and hearing, physiotherapists feeding or dressing, occupational therapists eliminating and podiatrists walking, for the 2027 and later taxation years in respect of certificates issued after 2026. They would also let a medical doctor, nurse practitioner or other listed practitioner certify only that an individual has a listed condition, including autism spectrum disorder level 3, for certifications issued for the 2026 and later taxation years. Do not describe these proposals to families as available [FED-18].

The CRA says the Child Disability Benefit is a tax-free monthly payment for families who care for a child under 18 with a severe and prolonged impairment. To get it you must be eligible for the Canada child benefit and the child must be eligible for the disability tax credit. Payments are recalculated every July, and for July 2026 to June 2027 the CRA lists up to $3,480 ($290 a month) for each eligible child [FED-19].

Contractors, advertising and online reviews

Federal tax and competition pages touch how a clinic treats contract therapists and how it advertises. The page for each province and territory covers employment standards, workers’ compensation and workplace safety.

• Employee or contractor: the CRA’s guide RC4110 asks first whether the parties intended an employment or a business relationship, then looks at control, tools and equipment, subcontracting work or hiring assistants, financial risk, responsibility for investment and management, and opportunity for profit [FED-20].
• Consequences and rulings: the guide says an employer who fails to deduct the required CPP contributions or EI premiums has to pay both the employer’s share and the employee’s share of any amounts owing, plus penalties and interest. A worker or payer can request a CPP/EI ruling by June 29 of the year following the year to which the question relates [FED-20].
• T4A slips: the CRA says that if you pay a fee to a person to provide a service outside an employment relationship, you generally need to fill out a T4A slip, including for payments between businesses such as sole proprietors and corporations [FED-21].
• Drip pricing: the Competition Bureau says advertising a low price and then adding mandatory fees raises concerns under the Competition Act, unless the added fixed charges are imposed by government on purchasers, such as sales tax. It adds that a variable charge could still raise concerns [FED-22].
• Online reviews: the Bureau’s digest describes astroturfing as commercial representations that masquerade as the authentic experiences of impartial consumers, and gives employees posting positive reviews and customers receiving incentives to leave them as examples. It says the misleading advertising provisions prohibit a representation that is false or misleading in a material respect, and that an undisclosed material connection, such as being an employee, is relevant even if the review is honest [FED-23].
• Regulators’ own rules on testimonials and review solicitation are separate from these federal pages and are compared on the reviews and testimonials page.

Federal payers, credential bodies and checks

These are pointers, not enrolment guides. Read each program’s own page before treating a client under it. For funding programs outside Ontario, a clinic should confirm every requirement with the program.

Credential bodies are not regulators. The BACB notice says Ontario’s Psychology and Applied Behaviour Analysis Act, 2021 is not based on BACB standards, certifications or certification tiers, that from 1 July 2024 only members of the College may use the title behaviour analyst, and that there are no regulatory requirements for assistant behavior analysts or behavior technicians [FED-29]. Outside Ontario we did not find a behaviour analyst regulator on the official pages we read; ask your funder and your regulator what credential they require.

Vulnerable sector checks: the RCMP says there is no federal legislation that requires any organization to conduct them. A check is a police information check plus a check for a record suspension for sexual offences, governed by section 6.3(3) of the Criminal Records Act [FED-30]. Accessible Canada Act: section 7(1) applies the Act to listed federal entities and to works, undertakings or businesses within Parliament’s authority, other than local or private ones in Yukon, the Northwest Territories or Nunavut. An ordinary provincially regulated private clinic is not among the entities listed there, in our reading, which is not advice from the government [FED-31].

TherapyCRM’s funding tracking is built around the Ontario Autism Program; it does not support Jordan’s Principle, the Inuit Child First Initiative, the Interim Federal Health Program or Veterans Affairs Canada.

Pending federal changes and where TherapyCRM fits

The first three items are a bill, proposals and a draft, not law. The last is a funding period stated in a briefing note. Re-check each source before relying on it.

TherapyCRM is practice management software with a clinical record for English-language clinics in Canada outside Quebec. Nothing on this page says that TherapyCRM meets any federal rule, and a clinic remains responsible for its own policies, its regulators’ standards and its legal advice.

Frequently asked questions