Therapy clinic regulations in Ontario: rules by topic and official source

Ontario at a glance

Use the table as a map, then read the section for each topic. Each row links to the official page we read on 8 October 2026.

Health privacy: PHIPA, custodians and agents

PHIPA governs health information custodians in Ontario. A health care practitioner, or a person who operates a group practice of health care practitioners, is a custodian. The Act defines a health care practitioner to include members of regulated health colleges who provide health care and any other person whose primary function is to provide health care for payment (s. 2). A federal order exempts custodians to which PHIPA applies from Part 1 of PIPEDA for the collection, use and disclosure of personal information that occurs within Ontario.

A custodian remains responsible for personal health information in its custody or control and may permit its agents to handle it only on the conditions in s. 17(1). An agent is a person authorized to act for the custodian in respect of the information, whether or not employed or paid (s. 2). An agent must notify the custodian at the first reasonable opportunity if information is stolen, lost, or used or disclosed without authority (s. 17(4)(b)). The Act uses the words group practice once and does not define them in the text we read, so who is the custodian in a multidisciplinary clinic owned by someone who is not a practitioner is a question for counsel or the Commissioner.

• Breach: notify the individual at the first reasonable opportunity, with a statement that they may complain to the Commissioner (s. 12(2)). Notify the Commissioner in the seven situations in O. Reg. 329/04, s. 6.3, which the Commissioner’s page summarizes. File the annual statistics report on or before 1 March (s. 6.4).
• Consent: a consent to disclose personal health information to a person who is not a custodian must be express, not implied (s. 18(3)).
• Access: a custodian may extend the time to respond to an access request by up to a further 30 days, with written notice of the length and the reason (s. 54(3) and (4)).
• Employees who are College members: a custodian must give written notice to the governing College within 30 days if such an employee is terminated, suspended or disciplined for unauthorized collection, use, disclosure, retention or disposal of personal health information (s. 17.1).
• Retention: PHIPA requires secure retention, transfer and disposal in accordance with any prescribed requirements (s. 13(1)). The periods that apply to clinic records come from each college.

Professional regulators in Ontario

Each clinician’s college sets the rules for that clinician’s records, fees, advertising and supervision, and the colleges differ. The table names the regulator and the Act for each profession and shows what each says about assistants and supervised staff. Record retention is in the retention table and advertising is in the reviews table.

Working with children

Four sets of rules meet in pediatric work: the duty to report, consent for a child, separated parents, and screening of staff.

• Reporting: any person who has reasonable grounds to suspect that a child under 16 is in need of protection must report the suspicion and its basis immediately, directly to a children’s aid society, and may not rely on someone else to report (CYFSA s. 125(1) to (3)). The duty does not apply to 16- and 17-year-olds, though a report may be made (s. 125(4)). A person who performs professional or official duties with respect to children, a group that includes a service provider and an employee of a service provider, commits an offence by not reporting and is liable to a fine of up to $5,000 (s. 125(5), (6) and (9)). The section applies although the information is confidential and prevails over PHIPA (s. 125(10) and (12)). The ministry’s page says to report to a children’s aid society or, if someone is in immediate danger, to call the police.
• Consent: for a child under 16, a parent, a children’s aid society or another person lawfully entitled to consent in the parent’s place gives PHIPA consent. The exceptions are treatment the child decided on alone under the Health Care Consent Act, 1996 and counselling the child took part in alone under the Child, Youth and Family Services Act, 2017 (s. 23(1), paragraph 2).
• Separated parents: CASLPO’s FAQ says either parent may consent when parents are not separated. When they are separated, the answer depends on the parenting time and decision-making arrangement, and joint decision-making means consent from both parents. A provider may proceed on a parent’s good-faith statement of sole authority, but may not rely on it once told that authority is shared or that the other parent disagrees. Document each consent discussion.
• Screening: we found no Ontario statute that requires private therapy clinics to obtain vulnerable sector checks. The Police Record Checks Reform Act, 2015 sets how police record checks are conducted and names three types of check. The Ontario Autism Program Provider List requires a clear vulnerable sector check completed within the past 12 months, and the list is voluntary during the 2026-27 service contract period.

Running the clinic as a business and employer

These rows cover the structure and workforce questions an owner meets first. Municipal licensing, zoning, building and fire rules were not researched; CASLPO’s private practice guide lists zoning by-laws and municipal regulations among the questions to take to a lawyer.

Funding programs and insurers

Funding rules sit outside the colleges and change often; each ministry page carries its own update date. The Ontario Autism Program guidelines we read were updated on 10 September 2026.

• Qualified providers: the guidelines say ABA services must be delivered or supervised by a behaviour analyst, psychologist or psychological associate registered with CPBAO; speech-language pathology by a speech-language pathologist registered with CASLPO (audiology is not eligible); and occupational therapy by an occupational therapist registered with COTO.
• Expenses: the guidelines list cancellation fees for missed or cancelled sessions among the expenses that are not eligible, and say invoices for technology and program materials must come with a letter of recommendation from a regulated professional delivering or overseeing services to the child.
• Provider List: during the 2026-27 service contract period the list is voluntary, so families receiving Ontario Autism Program funding can keep hiring registered providers who have not joined. Joining requires registration in good standing for autonomous practice, a clear vulnerable sector check completed within the past 12 months, professional liability insurance and one year of full-time post-registration experience with autistic children and youth.
• Auto insurance: the Financial Services Regulatory Authority of Ontario says a business that submits OCF-21 forms through HCAI must hold a service provider licence to invoice and be paid directly by auto insurers for listed expenses. A provider that only submits OCF-18 and OCF-23 forms and invoices claimants directly does not need one.

Dated changes and deadlines

Every row shows an absolute date. Check the linked page for the current text before relying on a row.

Official sources directory

These are the pages behind the rules above, one line each. Government and regulator sites change their addresses, so use the table links first and the regulator’s own site if a page has moved.

How TherapyCRM fits

TherapyCRM is practice management software with a clinical record for English-language practices in Canada outside Quebec. It does not tell a clinic which of the rules on this page apply, and nothing here says that using it satisfies any of them. Each clinic remains responsible for its own policies and for confirming requirements with its colleges, funders and counsel.

For clinics that serve families funded through the Ontario Autism Program, staff enter approved funding amounts and hours for a client, and the funding record keeps used and remaining amounts and hours. Invoices generated from completed sessions require current approved documentation and a service code.

Frequently asked questions