Records and privacy

Record keeping and privacy rules for registered psychotherapists in Ontario

Facts checked against CRPO's and Ontario's official sources on October 21, 2026.

A registered psychotherapist keeps an accurate, complete and legible clinical record for each client, and keeps it for at least 10 years from the last interaction or 10 years from the client's 18th birthday, whichever is later. The rules come from Section 5 of CRPO's Professional Practice Standards, on record keeping and documentation, and from Ontario's Personal Health Information Protection Act, 2004 (PHIPA), which governs access, security and breaches. On the exam they appear as options inside a case rather than as recall questions.

What goes in the clinical record

Standard 5.1.1 requires an "accurate, complete, and legible clinical record for each client". Complete means more than progress notes. CRPO's list includes:

a client profile, with any legal representative and the referral source and reason;
assessments (methods, results, conclusions) and the therapy plan with the client's consents;
progress notes: the client's statements, your observations, impressions and plans;
work product, consultations and referrals, and a note of every communication with the client, in or out of session;
reports sent or received, incident reports, and copies of mandatory reports (or a written summary of a verbal one);
a closing note with the reasons for ending.

Rough notes are generally not part of the record. If you do not keep them, use them to complete the record and destroy them the same day.

CRPO sets no number of days for writing a note: the record is "updated in a timely manner". Key information is kept in English or French; progress notes may be in the language of the therapy.

Correcting a record

Every entry shows who made it and when. An amendment shows what changed, when, by whom and why, and the original entry stays legible. Overwriting a note, even to fix an honest error, breaks this rule. Falsifying a record and failing to keep records in line with the standards are both acts of professional misconduct under O. Reg. 317/12 (paragraphs 25 to 27).

How long records are kept

Record	Standard	Minimum retention
Clinical record	5.1	10 years from the last interaction, or 10 years from the 18th birthday, whichever is later
Appointment and attendance record	5.4	The same
Financial record	5.5	The same

CRPO's own example: a child who was seven at the last interaction has a record kept until the 28th birthday.

The retention duty rests on the health information custodian, a PHIPA term. CRPO's Standards say an RP in solo practice is the custodian. An RP employed by an agency or hospital follows the employer's record policies. In a shared or group practice, CRPO says to settle in writing at the outset who owns the records.

When a client asks for their file

PHIPA (s. 52) gives clients a right of access to their own personal health information, subject to limited exceptions. The one most relevant to therapy is where access could reasonably be expected to result in a risk of serious harm to the client's treatment or recovery, or serious bodily harm to the client or someone else. Where an exception covers only part of a record, the rest that can reasonably be severed is released (s. 52 (2)).

The timeline and fee rules come from s. 54:

respond as soon as possible, and no later than 30 days after the request;
you may extend once, by up to 30 more days, with written notice and reasons;
take reasonable steps to confirm the person's identity first;
you may charge a fee only after giving an estimate, and it cannot exceed reasonable cost recovery. CRPO cites an Information and Privacy Commissioner example of $30 for the first 20 pages and 25 cents a page after that, and says the fee must not be a financial barrier.

Couple, family and group records have their own rule. A participant can see the whole joint record only if all participants consent or ask together. Otherwise they receive information about themselves and general information that cannot be attributed to another participant.

Security and privacy breaches

Standard 5.6.1 requires "steps that are reasonable in the circumstances to ensure that personal health information is protected against theft, loss and unauthorized use, disclosure, modification, or disposal." CRPO's examples:

physical: locked storage, screens out of view, micro-cut shredding;
electronic: encryption, passwords, automated backups with recovery tests, an audit trail of who wrote and viewed each entry, a fallback when the system fails;
administrative: need-to-know access, confidentiality agreements, privacy training, a disposal log.

If information is stolen, lost or misused, PHIPA s. 12 (2) requires you to notify the client at the first reasonable opportunity and tell them they may complain to the Information and Privacy Commissioner. Where the circumstances meet the requirements set by regulation, you must also notify the Commissioner (s. 12 (3)). Standard 3.1 says the same: inform the client promptly and, if applicable, the Commissioner.

How it is tested

Record-keeping items usually come late in a case: after a risk disclosure, an incident, or a lost laptop. Options that describe a complete note (statements, observations, the risk assessment, the plan) tend to carry positive weight. Options that delay the note until after supervision or rewrite an earlier entry tend to be negative. The record-keeping module covers reports, receipts and the full list of safeguards, and practice cases let you rehearse these choices under exam conditions.

Common questions

How long does an RP in Ontario keep client records?

At least 10 years from the last interaction with the client, or 10 years from the client's 18th birthday, whichever is later. The same period applies to clinical, appointment and financial records.

Does a client have the right to see their therapy notes?

Yes, under PHIPA s. 52, subject to limited exceptions such as a risk of serious harm to their treatment or recovery. You respond within 30 days, with one possible extension of up to 30 days.

Can I fix a mistake in a progress note?

Yes, by amendment. The amendment records what changed, when, by whom and why, and the original entry must remain legible.