Loading...
Privacy & Compliance
PHIPA-oriented guidance for Ontario RMTs using RMT Flow. This page is educational support only — not legal advice.
1. PHIPA Overview for RMTs
Under PHIPA, Registered Massage Therapists in Ontario are typically health information custodians when they have custody or control of personal health information (PHI) in connection with providing care.
Key obligations include:
- Obtaining appropriate consent to collect, use, and disclose PHI
- Collecting only what is necessary for the purpose
- Implementing reasonable safeguards (administrative, technical, physical)
- Allowing clients access to their own PHI and responding to correction requests
- Notifying individuals and the IPC of certain privacy breaches
- Maintaining information practices (policies) for how PHI is handled
CMTO’s Standard of Practice: Privacy and Confidentiality requires RMTs to comply with PHIPA and to use electronic tools in a way that protects client privacy.
2. How RMT Flow Is Designed
- No client legal names required — use private labels only (e.g. “Client A – Visit 2”)
- Client email addresses are not stored — one-time handout sends only, with explicit consent
- Session notes stay private per therapist — other clinic members cannot see your private sessions
- Clinic analytics are aggregated only — no client identifiers
- No diagnostic language — assessment considerations and clinical decision support only
- Login required — access controls and role separation (therapist / clinic admin)
If you choose to enter identifiable client information into free-text fields, you become responsible for treating that content as PHI under PHIPA.
3. Practical Compliance Checklist
Use this as a self-review checklist for your practice. Check items as you confirm them. Status is stored only in your browser (localStorage), not on the server.
Checklist progress is saved in this browser only.
4. Your Responsibilities vs RMT Flow’s Role
| Area | RMT Flow | Therapist / Clinic |
|---|---|---|
| Clinical judgment | Decision support only | Full professional responsibility |
| Client chart / record | Not a full EHR | Maintain required clinical records |
| Consent for treatment | Reminders only | Obtain and document consent |
| PHI identifiers | Designed to avoid them | Do not enter unnecessary PHI |
| Breach response | Technical safeguards | Policies, notification, IPC duties |