For Canadian practices outside Quebec

PHIPA and therapy clinic software: a privacy checklist before you buy

PHIPA and therapy clinic software come down to one fact: no software makes a clinic compliant by itself, because Ontario’s health privacy law applies to the clinic and its people, policies and contracts. This guide gives you the questions to put to any vendor, what to verify in a demo with fictional data, and what TherapyCRM does and does not state, including that it holds no privacy or security certification.

General operating guidance with a fictional demo script. This is information, not legal advice, and it makes no claim that any product satisfies PHIPA, PIPEDA or another privacy law. Ask your college, privacy officer or counsel about your own obligations.

Last updated: 2026-10-26

By the TherapyCRM team at Data Inn Inc.

Fictional worked example; information, not legal advice.

What software can and cannot do for PHIPA

PHIPA is Ontario’s health privacy statute. Software is one of the tools a clinic uses to follow it, not a substitute for following it.

Software can support the work: limit who sees a record, keep a trail of who did what, and protect data in storage and transit.
Software cannot decide your consent practices, train your staff, or write your privacy policy.
It also cannot decide who the health information custodian is. That is the clinic’s decision, made with its advisers.
A vendor that claims to be compliant with PHIPA is making a claim about itself that you cannot verify from a badge. Ask for the evidence instead.

Other provinces outside Quebec have their own statutes, so a clinic in another province should check its own law before using this list.

Eight questions to ask any vendor

Put these in writing to every vendor on your shortlist and compare the answers side by side.

Access: which roles exist, and can we limit each one by branch and by task?
Accountability: does the system keep an audit trail, and who can read it?
Sign-in: is multi-factor authentication available, and how long do staff sessions last?
Location: where are production data, uploaded files and backups stored, and which providers process data elsewhere?
Service providers: who are the subprocessors, and what does each one receive?
Optional features: what leaves the system if we turn on AI, text messages or a connected calendar?
Exit: how do we export our records, and what happens to the data when we leave?
Incidents: how and how quickly will you tell us about a problem that touches our records?

What to ask, what to verify in a demo, and where TherapyCRM states it

A claim on a web page is a starting point. This table pairs each question with a demo check and the place TherapyCRM publishes its answer.

Swipe or scroll sideways to view all table columns.

Vendor privacy checklist with a demo check and TherapyCRM source for each row
Ask the vendor	Verify in a demo	Where TherapyCRM states it
Role-based access	Sign in as a front-desk role and as a clinician; compare what each can open.	The Security page states role-based access scoped to the practice and branch.
Audit trail	Edit a fictional record, then ask to see the entry showing who changed it.	The Security page states audit trails and says to ask how your configuration handles them.
Sign-in controls	Ask to see multi-factor sign-in and how a staff session ends.	The Security page states multi-factor authentication and short staff sessions.
Data location	Ask for the subprocessor list and match each provider to a feature you plan to use.	The Security page and subprocessor list name the location and the exceptions.
Offline devices	Interrupt the connection during a fictional session and ask where the draft sits.	The Security page states an encrypted draft on the device that needs later synchronization.
Certification	Ask what privacy or security certification the vendor holds.	TherapyCRM states that it holds none.

The checks are prompts for your own review. A feature present in a demo does not show that your configuration meets your obligations.

What TherapyCRM states, and what it does not

TherapyCRM publishes where its data is held, and names the exceptions.

The production application, database, uploaded files and backups run on Google Cloud in Toronto, and the session cache is in Canada.
Named exceptions: providers for email and text messages, payments, optional AI features, app notifications, bot checks, optional website analytics and video, and calendars a practice connects process limited data outside Canada, and rollback and testing copies are held in the United States and Germany.
The Security page describes role-based access scoped to the practice and branch, multi-factor authentication, short staff sessions, audit trails, and encrypted storage and transport.
TherapyCRM holds no privacy or security certification.
It does not state that using it makes a clinic compliant with PHIPA, PIPEDA or any other law.

Your practice controls staff responsibilities and must review access when roles change or people leave.

A fictional demo script: 20 minutes

Use made-up people only. Never bring a real child’s record to a vendor demo.

Create a fictional child, “Sam Example”, with two guardians and one clinician.
Sign in as a front-desk user and try to open Sam’s session notes. Note what is blocked.
Sign in as the clinician and write a short fictional note. Ask where that action appears in the audit trail.
Ask the presenter to show a staff member’s access being removed, and check what that user can still reach.
Ask which providers receive data if you switch on text reminders or AI features.
Ask what a family member sees in the portal and who decides it.
Finish by asking for the written answers to the eight questions above.

Red flag: A vendor that cannot show who changed a record, or will not name its subprocessors, has not answered the question yet.

Edge cases a software checklist will not settle

These are decisions for the clinic, not features to look for.

Custodian: a clinic owner, a corporation and a contracted clinician may each be in a different position. Ask your counsel who is the health information custodian before you configure access.
Consent: the guardian’s role, a mature minor’s own choices and any substitute decision-maker are your policy, not a setting.
Breach reporting: your clinic needs a written plan for who investigates, who tells families and when the Commissioner is notified. Check the Commissioner’s guidance before an incident, not during one.
Shared devices: an iPad at the front desk or a clinician’s tablet needs a rule for sign-out, loss and synchronization.

Trade-offs to weigh

Stricter controls cost convenience, so decide where your clinic sits.

Narrow roles protect records but add requests to the administrator when staff cover for each other.
Short sessions reduce exposure on a shared screen but mean more sign-ins during a busy day.
Optional features such as AI and text messages save time but send limited data to the providers named on the subprocessor list.
A vendor without a certification can still be reasonable to buy, but the clinic then carries more of the review itself.
A one-person practice and a multi-branch group need different levels of paperwork, so size your review to your clinic.

Next step

Take the table to a demo, run the fictional script and keep the written answers with your own privacy notes. TherapyCRM serves English-language practices in Canada outside Quebec. It is practice management software with a clinical record, not a physician EMR, and has no EMR certification. It holds no privacy or security certification. It has no telehealth or video visits and does not submit insurance or government claims, including Ontario Autism Program claims.

Frequently asked questions

Is there software that makes a therapy clinic compliant with PHIPA?

No product makes a clinic compliant on its own. PHIPA applies to the clinic as custodian or agent, so compare vendors on the evidence they give you and then build your own policies, training and contracts around it.

Does TherapyCRM hold a privacy or security certification?

No. TherapyCRM holds no privacy or security certification. It states role-based access, multi-factor authentication, audit trails and encrypted storage and transport, and each practice assesses those against its own obligations.

Where does TherapyCRM store data?

The production application, database, uploaded files and backups run on Google Cloud in Toronto, and the session cache is in Canada. Named exceptions: providers for email and text messages, payments, optional AI features, app notifications, bot checks, optional website analytics and video, and calendars a practice connects process limited data outside Canada, and rollback and testing copies are held in the United States and Germany. The subprocessor list names each provider and location.

Who is the health information custodian at my clinic?

That is a legal question about how your clinic is set up, and software does not answer it. Ask your counsel or privacy officer before you assign roles or sign a vendor agreement.

What should we do if there is a privacy breach?

Follow your written plan and check the Information and Privacy Commissioner of Ontario’s guidance on reporting. A vendor should tell you promptly about anything that touches your records, so ask how it does that.

Can a vendor demo use real client data?

No. Use fictional children and guardians so no real health information is shown to the vendor or entered into a trial environment.

Does this checklist work for clinics outside Ontario?

The questions apply to any Canadian clinic outside Quebec, but the statute and the reporting steps differ by province. Check your own province’s law and regulator.