Contents

PHIPA custodian duties for psychotherapists

PHIPA custodian duties for psychotherapists

Custodian responsibilities

Under PHIPA, Ontario psychotherapists in private practice who collect personal health information are typically health information custodians. Duties include:

  • Reasonable safeguards for PHI (PHIPA s.12)
  • Access requests within 30 days
  • Retention and secure destruction per policy
  • Breach response and notification when required
  • Agent agreements with vendors that handle PHI on your behalf

CRPO's PHIPA FAQ reminds registrants that custodian obligations apply to clinical records and the PHI they contain.

Adding a document-collection layer

When intake moves from email to Hivi-X:

  1. Update your privacy impact assessment
  2. Document why pre-session copies exist alongside your EMR
  3. Align retention and deletion schedules
  4. Train yourself or admin staff on approve/reject and access limits
  5. Export intake into the chart of record when appropriate

Hivi-X is not a custodian substitute — it is infrastructure you evaluate and control.

Technical safeguards Hivi-X provides

  • Canadian server hosting
  • AES-256-GCM encryption at rest; TLS in transit
  • Self-hosted AI for voice summaries — no third-party AI providers
  • Secure guest link or authenticated my-id.ca client portal

General information for Ontario psychotherapists and counselling practices only. Not legal, clinical, privacy, or psychotherapy advice. Not affiliated with or endorsed by CRPO or any college. Hivi-X is document-collection software — it is not a licensed psychotherapist, does not provide psychotherapy or clinical assessments, does not certify PHIPA or CRPO compliance, and does not replace your EMR or clinical record obligations. You remain the health information custodian under PHIPA. Consult qualified counsel and your professional liability insurer.

PHIPA statute: ontario.ca/laws/statute/04p03 · CRPO PHIPA FAQ

Answers are general operational information only — not legal, tax, regulatory, clinical, privacy, immigration, or professional advice. Requirements vary by matter, client, and regulator.

Frequently asked questions

Is Hivi-X PHIPA-certified?
No certification exists for PHIPA compliance. Hivi-X provides technical safeguards you may review in vendor due diligence. You remain the health information custodian.
Where is client data stored?
On servers hosted in Canada. AI processing uses Hivi-X infrastructure — client data is not sent to OpenAI, Google, or Anthropic.
What should I review before adopting Hivi-X?
Data flows, retention alignment with your EMR policy, access controls, agent agreements where required, breach notification terms, and client-facing consent language for portal collection.

Collect complete intake before session one

Hivi-X helps Ontario CRPO psychotherapists and counsellors collect informed consent, biopsychosocial forms, insurance cards, and telehealth consent with reusable checklists, a secure guest link (no account needed) or my-id.ca portal, self-hosted AI summaries, and exportable intake packages for Jane, Owl Practice, or your EMR.

PHIPA Custodian Duties For Psychotherapists | hivi-x Docs