Mandatory Reporting and the Limits of Confidentiality

The shape of the problem

Confidentiality is the cornerstone of psychotherapy, and CRPO says so. It is also not absolute. The examinable skill is not knowing that exceptions exist, but placing a situation into one of three boxes fast:

• Mandatory. The law requires disclosure. Your judgement goes to how and how much, not whether. Failing to report can be an offence, professional misconduct, or both.
• Permissive. The law allows disclosure. Whether you disclose is a professional judgement and the default remains confidentiality. Over-disclosure here is a real failing, not a safe hedge.
• Prohibited. You may not disclose, and no clinical reasoning rescues it.

Candidates lose marks in both directions: by failing to make a required report, and by making disclosures no law authorises because they felt urgent. Every duty below is set out as trigger, threshold, clock and recipient, because those four facts decide the answer.

Child protection: the Child, Youth and Family Services Act, 2017

This is the most heavily examined duty and the one with the most distinctive features.

Five features of this duty are examined again and again. Learn them as a block.

1. The threshold is reasonable grounds to suspect, not belief, and not proof. You do not investigate first, interview the child to firm it up, or wait for corroboration. The statute's test is reasonable grounds to suspect: a suspicion that rests on something concrete you saw or were told, not on rumour, speculation or a vague unease. If you are asking yourself whether you have enough, you generally have enough to call and describe what you have. The children's aid society decides whether to investigate. That decision is not yours.

2. The duty is personal. You report. You do not discharge the duty by telling your supervisor, your clinical director, your manager or your agency's designated person, and you may not rely on anyone else to report on your behalf. An option in which the RP "informs the supervisor, who will make the report" is a negative, and in a scenario where the threshold is plainly met it is a serious one.

3. It is non-delegable in both directions. You cannot pass it up, and an employer cannot take it off you. An instruction not to report does not relieve you, and you should document that you were given it.

4. The duty is ongoing. Even if you know a report has already been made about the same child, you make a further report when additional reasonable grounds arise. "The agency already has an open file" is not an answer.

5. It overrides confidentiality, and you are protected. No action lies against a person who reports in accordance with the duty unless they acted maliciously or without reasonable grounds. A professional who fails to report information obtained in the course of professional duties commits an offence, and on conviction is liable to a fine of not more than $5,000.

Grounds in outline. The statute enumerates the circumstances in which a child is or may be in need of protection. In substance: physical harm inflicted by a person having charge, or resulting from inadequate care or supervision, and the risk of it; sexual abuse or exploitation, and the risk of it; failure to provide needed medical treatment; emotional harm shown by serious anxiety, depression, withdrawal, self-destructive or aggressive behaviour or delayed development, the risk of it, and failure to provide treatment for it or for a mental, emotional or developmental condition; sexual exploitation through child sex trafficking, and the risk of it; a parent who has died or cannot exercise custody and has made no adequate provision, or who refuses or is unable to resume charge of a child in care; and certain conduct by a child under 12 who has harmed a person or property.

Verified against e-Laws on 23 September 2026. CYFSA s. 125 (1) opens "Despite the provisions of any other Act, if a person, including a person who performs professional or official duties with respect to children, has reasonable grounds to suspect one of the following, the person shall immediately report the suspicion and the information on which it is based to a society". The grounds run 1 to 13, with 4.1 and 4.2 added for child sex trafficking. They cover physical harm and the risk of it, sexual abuse or exploitation and the risk of it, a child needing treatment for physical harm that a parent will not provide, emotional harm and the risk of it, a mental, emotional or developmental condition going untreated, a parent dead or unavailable with no provision made, and two grounds about a child younger than 12 who has harmed someone or damaged property. The other subsections carry the features examined here: s. 125 (2) the ongoing duty, s. 125 (3) "shall make the report directly to the society and shall not rely on any other person to report on the person's behalf", s. 125 (4) that the mandatory duty does not apply to a child of 16 or 17 but a report may still be made on grounds 1 to 11, s. 125 (5) and (6) the offence for professionals, s. 125 (9) a fine of not more than $5,000, s. 125 (10) that the section overrides confidentiality and privilege and protects a reporter who is not malicious and has reasonable grounds, s. 125 (11) that solicitor-client privilege survives, and s. 125 (12) that the section "prevails despite anything in the Personal Health Information Protection Act, 2004".

What you tell the client. Tell the client you are making the report, and why, unless telling them would increase the risk to the child. Do this before or at the time of reporting, not afterwards to salvage the session.

What you keep doing. Reporting does not terminate treatment, does not require you to hand over the clinical record, and does not make you an investigator. You report the suspicion and the information it rests on, and you continue to treat. Keep a copy of a written report in the clinical record, or a written summary where the report was made verbally.

Sexual abuse of a client by a regulated health professional

Definition. Sexual abuse of a patient by a member has three branches: sexual intercourse or other physical sexual relations between member and patient; touching of a sexual nature of the patient by the member; and behaviour or remarks of a sexual nature by the member towards the patient. It does not include touching, behaviour or remarks of a clinical nature appropriate to the service being provided.

The in-practice limit. The duty attaches to information obtained in the course of practising the profession. What you learn at a dinner party about a friend's therapist does not trigger the statutory duty, though it may still support a complaint. This limit is a favourite distractor.

The client's name. The report must name you and the member who is the subject, and set out the grounds for your belief. Reports are not anonymous. The patient's name may be included only with the patient's written consent. Crucially, the absence of that consent does not excuse the report: you file it without the name. Candidates who answer "the client would not consent, so I could not report" have the rule exactly backwards.

Advising the client. Tell the client about the duty before you file, and discuss whether they wish to be named.

If you are treating the member who is the subject. Where the person you must report is your own client, the report must include your opinion as to whether they are likely to sexually abuse patients in future, and if they cease therapy you file a further report.

The five-year rule. For the purposes of sexual abuse allegations, an individual remains a client for five years after the professional relationship ends. Since 29 August 2025 this period is set in regulation as well as in CRPO's standard: CRPO's Standard 1.8 page cites O. Reg. 202/25 alongside the patient criteria in O. Reg. 260/18. Not one year. Sexual contact inside that window is strictly prohibited, and after five years CRPO's position is that a continuing power imbalance may make it never appropriate. Sexual intercourse with a client carries mandatory revocation.

Incompetence, incapacity and termination

These are grouped because candidates merge them and the exam exploits the gap.

Facility operators

A person who operates a facility where a member practises must report to the Registrar of that member's college where they have reasonable grounds to believe the member is incompetent, incapacitated, or has sexually abused a patient. The clock is 30 days, or forthwith where the member is likely to go on sexually abusing patients, or their incompetence or incapacity is likely to expose a patient to harm and there is urgent need for intervention (HPPC s. 85.3 (2)). The report must be filed whether or not the professional is terminated.

Termination or dissolution of a professional relationship

Any person who employs or engages a member, whether or not that person is themselves a regulated health professional, must report to the Registrar in writing within 30 days where they terminate the employment, revoke, suspend or restrict privileges, or dissolve a partnership, association or corporate relationship for reasons of professional misconduct, incompetence or incapacity. Where the member resigns or gives up or restricts their privileges or practice, the duty still arises if the person has reasonable grounds to believe that this is related to misconduct, incompetence or incapacity, or if it happens during or because of the person's investigation of such allegations (HPPC s. 85.5 (2)).

CRPO reads this broadly: employers, partnerships, professional corporations, associates and space-sharing arrangements. The report names the reporter and the member and summarises the grounds. A registrant who quietly ends a colleague's room rental because of concerns about their practice has a reportable event.

Another RP's unsafe practice

CRPO lists this as a mandatory report. Its Filing a Report page lists the situations in which a person is legally required to report to the College, promptly and in writing, and one of them is "a Registered Psychotherapist has reasonable grounds to believe that another RP has practised unsafely". Answer exam items on that basis: an RP who has reasonable grounds to believe another RP has practised unsafely reports it to CRPO, promptly and in writing. CRPO states no fixed number of days for this report; the 30 day clock belongs to the sexual abuse duty and to employers.

Two points keep this from being over-read. The sexual abuse duty is the one that reaches every regulated health professional, whatever their college; the unsafe practice report is about another RP. And the source of the duty is not the Procedural Code's reporting sections, which are drafted around sexual abuse, facility operators and employers (which is why some secondary sources wrongly call other colleague reports permissive). It is the psychotherapy profession's own misconduct regulation: failing "to promptly report to the College an incident of unsafe practice by another member if the member believes on reasonable grounds that the other member has committed such an incident" is professional misconduct (O. Reg. 317/12, s. 1, para. 39), and so is naming a client in that report without their consent unless the law authorizes or requires it (para. 40). CRPO's Standard 1.3.1 requires registrants to comply with their mandatory reporting obligations, and its Filing a Report page lists this one. It is enforced through discipline, not as an offence with a fine.

Two counterweights apply. CRPO's standard requires registrants to refrain from frivolous or vexatious complaints or reports, so this is no licence to report a colleague you dislike. And a clinical supervisor must distinguish a supervisee's ordinary learning error from unsafe practice that triggers reporting.

Self-reporting to the College

Every registrant must report certain events about themselves to CRPO's Registrar. The timing is as soon as reasonably practicable after the event, and CRPO is explicit that these are not to be saved up for annual renewal.

The reportable events include:

• A finding of guilt for any offence: Criminal Code, federal drug legislation, or any provincial offence statute. Absolute and conditional discharges count, not just convictions. Speeding and parking tickets are excluded.
• Outstanding charges, and any bail conditions or other restrictions, including publication bans.
• A court finding of professional negligence or malpractice. It must be a court finding; a settlement without one is not caught.
• A finding of professional misconduct, incompetence or incapacity by another regulator, in any jurisdiction and any profession, and a current proceeding of that kind.
• Refusal of registration or licensure by any body, and resignation from another regulator.
• Registration with another regulatory body.
• Change of name or contact information.
• A catch-all: any other event providing reasonable grounds to believe the registrant will not practise safely and professionally.

Verified against e-Laws on 23 September 2026. The allocation in the Health Professions Procedural Code is: s. 85.6.1, found guilty of an offence; s. 85.6.2, a finding of professional negligence or malpractice; s. 85.6.3, membership of another body governing a profession inside or outside Ontario, and any finding of professional misconduct or incompetence made by it; s. 85.6.4, being charged with an offence, including "information about every bail condition or other restriction". Each is filed in writing with the Registrar "as soon as reasonably practicable" after notice. Section 85.5 is the separate duty on a person who ends an employment or business relationship with a member for misconduct, incompetence or incapacity, filed within thirty days.

Two related obligations travel with this. Registrants must reply appropriately and within 30 days to a written inquiry from the College and cooperate fully with an investigation. And practising, or taking any benefit from professional status, while under suspension is serious misconduct.

Long-term care homes and retirement homes

These duties bind every person, not only staff, so they bind an RP who works in, visits, or serves clients in such a home. Residents are exempt.

Long-term care homes are governed by the Fixing Long-Term Care Act, 2021, which replaced the earlier legislation in 2022. The threshold is reasonable grounds to suspect, the clock is immediately, and the report goes to the Director at the Ministry of Long-Term Care. Reportable matters include improper or incompetent treatment or care that resulted in or risks harm; abuse of a resident by anyone; neglect by the licensee or staff; unlawful conduct resulting in or risking harm; and misuse or misappropriation of a resident's money or of the home's funding.

Retirement homes are governed by the Retirement Homes Act, 2010. Again the threshold is reasonable grounds to suspect, the clock is immediately, and the report goes to the Registrar of the Retirement Homes Regulatory Authority. Reportable matters are improper or incompetent care, abuse or neglect, and unlawful conduct, each resulting in or risking harm to the resident, and misuse or misappropriation of a resident's money, which needs no harm (RHA s. 75 (1)).

For both: confidentiality is expressly overridden, and whistle-blower protection applies, so a registrant cannot lawfully be dismissed, disciplined or suspended for reporting or cooperating with an inspection.

Verified against e-Laws on 23 September 2026. The pinpoint is Fixing Long-Term Care Act, 2021 s. 28 (1): "A person who has reasonable grounds to suspect that any of the following has occurred or may occur shall immediately report the suspicion and the information upon which it is based to the Director". The duty is universal, not limited to staff, and s. 28 (3) exempts residents, who may report but are not required to. The five triggers are improper or incompetent treatment or care that harms or risks harm, abuse by anyone or neglect by the licensee or staff that harms or risks harm, unlawful conduct that harms or risks harm, and misuse of a resident's money or of the licensee's funding. Section 28 (4) overrides confidentiality and privilege for college members and protects a reporter unless they act maliciously or without reasonable grounds, s. 28 (5) makes failure to report an offence for the people it lists, which include anyone providing professional health services to a resident, and s. 28 (7) preserves solicitor-client privilege. The number 24 belongs to the licensee's separate duty to protect residents, and was the reporting section in the repealed Long-Term Care Homes Act, 2007.

Permissive disclosures

Everything in this section is a may, not a shall. Getting this wrong is the single most common error in this area of practice.

CRPO's confidentiality standard lists these as notable limits to confidentiality, where disclosure without consent is permitted; the list is not exhaustive:

1. To reduce a significant risk of serious harm, physical or psychological, to the client or anyone else, for example suicide or homicide.
2. Mandatory reports (the section above).
3. Legal proceedings, where you are subpoenaed or otherwise legally required.
4. Investigations or inspections authorised by warrant or by provincial or federal law.
5. Contacting a relative, friend or potential substitute decision-maker where the individual is injured, incapacitated or ill and unable to consent personally.
6. College proceedings under the RHPA, including a complaint or a quality assurance assessment.

PHIPA supplies the statutory authority for the first of these: a custodian may disclose personal health information where they believe on reasonable grounds that disclosure is necessary to eliminate or reduce a significant risk of serious bodily harm to a person or group.

Verified against e-Laws on 23 September 2026. PHIPA s. 40 (1): a custodian "may disclose personal health information about an individual if the custodian believes on reasonable grounds that the disclosure is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to a person or group of persons." It is a permission, not a duty, and it is limited to what that purpose needs. The neighbouring pinpoints are s. 41 (1) (a) for a proceeding the custodian is party or witness to, s. 41 (1) (d) for "complying with a summons, order or similar requirement issued in a proceeding by a person having jurisdiction to compel the production of information" or a procedural rule about production, and s. 43 (1) (h) for a disclosure "permitted or required by law".

Duty to warn, duty to protect, and what Ontario actually requires

There is no general statutory duty to warn in Ontario. There is a discretion to disclose. CRPO's own standard says a registrant "may have" a professional and legal duty to warn, notes that the law in Canada on this is complex and evolving, and recommends legal consultation. Treat any simulation option that presents warning as automatic and mandatory with suspicion.

The analytical framework comes from the Supreme Court of Canada's decision in Smith v Jones, [1999] 1 S.C.R. 455, which held that even solicitor-client privilege, the strongest privilege known to law, yields where public safety is at stake. If that privilege yields, therapist confidentiality certainly does.

The Court set out three factors:

1. Clarity. Is there a clear risk to an identifiable person or group of persons? Look for evidence of planning, a method, a history of violence, and whether the threat is directed at specific, identifiable people. A group can be identifiable enough; it does not have to be one named individual.
2. Seriousness. Is there a risk of serious bodily harm or death? The gravity must be one of violence, serious bodily harm, serious psychological harm or death. A planned future non-violent crime, for example a fraud, does not meet this.
3. Imminence. Is the danger imminent? There must be an urgency that warrants intervention. A fixed time frame is not always required: a detailed, chilling threat of future violence can qualify if a reasonable person would believe it would be carried out. Fleeting anger will not do.

A practical fourth question, which CRPO's guidance also asks: are there less intrusive means of protecting the person at risk?

Verified against the judgment on 23 September 2026. The three factors are set out at paragraph 77: "There are three factors to be considered: First, is there a clear risk to an identifiable person or group of persons? Second, is there a risk of serious bodily harm or death? Third, is the danger imminent?" Paragraph 78 says they overlap and all must be weighed; clarity runs to paragraph 81, seriousness to 83, imminence at 84, and paragraph 85 is the summary. Paragraph 86 has moved on to how far disclosure may go, so cite paragraphs 77 to 85 for the factors themselves.

The Ontario overlay, as CRPO frames it:

• "Significant risk" sits between the extremes of low risk and certainty, and is assessed case by case on likelihood and magnitude together.
• "Serious bodily harm" means death or any hurt or injury that interferes in a substantial way with a person's integrity, health or well-being, and it includes serious psychological harm.
• Seek early consultation: a supervisor, a colleague, legal counsel, or CRPO's practice advisory service.
• Consider the therapeutic and safety implications of telling the client, and tell them where it is safe to do so.
• Disclose only as much as is needed to address the future harm. Redact matters unrelated to the risk. The scope error is as costly as the decision error.
• Disclosure may be made to the intended victim, to police or crisis services, or to a physician, depending on who can actually reduce the risk.
• Document the date, the time, the grounds relied on, the consultations, the content of what was disclosed, and the reasoning.

The clinical sequence matters as much as the legal test: assess, work with the client, consult, then disclose the minimum to the person who can act. An option that telephones police before the risk has been assessed is a negative even where, after assessment, calling police would have been right.

The Mental Health Act: when a client may need hospital assessment

The Mental Health Act governs admission, detention, assessment and treatment in psychiatric facilities. An RP exercises none of its powers, but you will refer clients into this system, work inside it, or be named in a community treatment plan. The facts below are CRPO's, from Part 3 of its jurisprudence manual.

Admission status.

• A voluntary patient may leave at any time and, if capable, may refuse treatment. The Act does not authorize detaining or restraining a voluntary patient; only a common law emergency exception applies, where there is a risk of serious bodily harm.
• An informal patient was admitted on a substitute decision-maker's consent and has a voluntary patient's rights, except that the substitute may make some decisions, including whether to leave.
• An involuntary patient is held on a physician's Certificate of Involuntary Admission (Form 3), valid for up to two weeks; renewals (Form 4) run for up to one month, then two, then three. When a certificate expires without a renewal, the person becomes voluntary. An involuntary patient may still refuse treatment if capable, and may get legal advice, speak to a rights adviser and ask the Consent and Capacity Board to review the certificate.

Form 1. Only a physician completes an Application for Psychiatric Assessment, and only after examining the person within the past seven days. Once it is signed, anyone may take the person to a psychiatric facility within seven days, and the person may be held for up to 72 hours for assessment. The usual route needs reasonable cause to believe the person has threatened or attempted self-harm, has been violent or caused another person to fear bodily harm, or has shown a lack of competence to care for themselves, together with the physician's opinion that a mental disorder will likely cause serious bodily harm or serious physical impairment.

Restraint is for involuntary patients only, apart from the emergency exception, and every use is documented, including the means used and the behaviour that required it. Breaching the Act, including its rules on restraint, is an offence.

Community treatment orders. A CTO lets a person live in the community on a treatment plan they consent to. The physician who signs it supervises it, and it expires after six months unless renewed or ended early. An RP named in the plan must agree to it and provide what it sets out, and may share personal health information with the physician and the others named in the plan, an authority that overrides PHIPA and the HCCA. CRPO's example: a client on a CTO tells his RP he has stopped the medication the plan requires, and she checks the plan and tells the physician.

What this means in a session. Your route to a psychiatric assessment runs through a physician, an emergency department or crisis services, never through detaining or restraining anyone yourself. CRPO's own practice question: a voluntary inpatient tells her RP she is suicidal and is leaving now. The best answer is to keep counselling her, notify the officer in charge at once so a physician can assess her before she goes, and document. Restraining her has no legal basis unless immediate action is clearly needed to prevent serious bodily harm, and helping her pack ignores the risk.

When you are served with a legal document

Three instruments, three different responses, and a separate route for records sought from a non-party before trial.

• A summons to witness is the term used in Ontario civil and provincial offence proceedings. Rule 53.04 (1) of the Rules of Civil Procedure, R.R.O. 1990, Reg. 194, lets it require the witness "to produce at the trial the documents or other things ... that are specified in the summons", so it reaches what the summons names and nothing more.
• A subpoena is the equivalent term in criminal proceedings and in federal courts and tribunals. Criminal Code s. 700 (1) requires the witness to attend and, "if required, to bring with him anything that he has in his possession or under his control relating to the subject-matter of the proceedings". A subpoena for therapeutic records in the sexual offence proceedings listed in s. 278.11 must be issued by a judge, s. 699 (5.1).
• Before trial, records held by someone who is not a party, which is usually the therapist's position, come only by court order on a motion, rule 30.10 (1), and only where the document is not privileged, is relevant to a material issue, and it would be unfair to make the moving party go to trial without it. At trial, a summons to witness can still require a non-party to bring what it specifies.
• A court order is a judge's direction made after adjudication, for example an order for production, or a ruling on an application for third-party therapy records in a sexual offence prosecution.

The rule to memorise: a summons to attend is not authority to release the file. It compels your attendance, and the production of what is listed, to the court. It does not decide that the records are admissible and it does not displace confidentiality. Couriering the file to the lawyer who had the summons issued is a privacy breach, and one of the most reliably examined errors in this area. A court order, by contrast, must be complied with to the extent of its terms.

What to do, in order:

1. Do not release records immediately. CRPO is explicit that registrants may have options, including negotiating an alternative or filing a legal objection.
2. Get independent legal advice. The competency profile treats initiating a legal consultation as a competency in its own right. Check your professional liability insurance, and contact CRPO's practice advisory service.
3. Make reasonable efforts to inform the client, including about steps taken to resist disclosure, so the client can obtain their own counsel.
4. Attend as required. A summons compels attendance and failing to attend risks a bench warrant. Attending is not producing.
5. Assert confidentiality on the record and ask the court to rule. Seek the narrowest production, review of the records by the judge, sealing, or a publication ban.
6. Produce only what is ordered, severing unrelated third-party information. This is critical in couples, family and group records, where the file holds another person's health information.
7. Document everything, and keep a copy of exactly what was produced.

Verified on 23 September 2026 against the Rules of Civil Procedure, R.R.O. 1990, Reg. 194 and the Criminal Code. In an Ontario civil proceeding the instrument is a summons to witness, rule 53.04 (1), which "may also require the person to produce at the trial the documents or other things in his or her possession, control or power relating to the matters in question in the action that are specified in the summons". Production has to be specified; it is not swept in by the summons to attend. Getting records from a non-party before trial is a different thing again and needs a court order on a motion, rule 30.10 (1). In a criminal proceeding the instrument is a subpoena, Criminal Code s. 698 (1), and s. 700 (1) requires the person to attend "and, if required, to bring with him anything that he has in his possession or under his control relating to the subject-matter of the proceedings". Therapeutic records in the sexual offence proceedings listed in s. 278.11 are screened by a judge, and the subpoena for them must be issued by a judge, s. 699 (5.1). The practical rule for a registrant does not change: being required to attend is not by itself authority to hand over a clinical file. Bringing a record to court is not releasing it, and privilege and confidentiality are ruled on by the judge.

The decision table

Four things to carry into the exam

1. Suspect, for children. Believe, for colleagues. The two thresholds are different on purpose, and simulations are built on the difference.
2. Personal, immediate, ongoing. The child protection duty is yours, it is now, and it recurs with each new piece of information.
3. Permissive means judgement, not permission to relax. Disclosing more than the risk requires is a failure, even when disclosing something was right.
4. A summons is an invitation to the courthouse, not a licence to hand over the file.