Privacy & Compliance

PHIPA-oriented guidance for Registered Massage Therapists using RMT Flow in Ontario / Canada. This page supports professional accountability under the CMTO Standard of Practice: Privacy and Confidentiality.

Important Context

RMT Flow is a clinical decision-support and documentation aid — not a full electronic health record (EHR). It is designed to minimize personal health information (PHI).

Private labels are used instead of real client names
Client email addresses are used only for one-time handout delivery and are not stored
Clinic analytics are aggregated and anonymized
Session notes, annotations, and progress data remain private to each therapist

Primary applicable law for Ontario RMTs is PHIPA (Personal Health Information Protection Act). HIPAA applies to US contexts and is not the primary obligation for CMTO-regulated practice unless you treat US patients or store US PHI.

PHIPA / CMTO Practical Checklist

Use this checklist to support good information practices. Adapt it to your clinic policies.

Consent: Obtain informed consent for assessment and treatment. Document consent in your clinical record system.
Minimal collection: Collect only the information needed for care. RMT Flow supports this by using private labels rather than full client identifiers.
Access control: Keep your RMT Flow login private. Use strong passwords. Log out on shared devices.
Private labels: Do not put real client names, health card numbers, or other identifiers into private session labels if you wish to keep the tool free of identifiable PHI.
Email handouts: Confirm the recipient has consented before emailing a home-care sheet. Client emails are not stored by RMT Flow.
Clinic members: Ensure only authorized therapists join your clinic account. Review the member list periodically.
Exports & downloads: Treat downloaded notes, CSVs, and diagrams as confidential. Store them securely.
Breach awareness: Know your clinic’s process for suspected privacy breaches. Report as required under PHIPA / clinic policy.
Retention: Follow your professional and clinic retention schedule for any records you create outside RMT Flow.
Training: Ensure all clinic users understand PHIPA basics and the CMTO Privacy and Confidentiality standard.

How RMT Flow Handles Data

Account & login	Email + hashed password. Session cookies.
Private sessions	Stored per therapist under a label you choose. No requirement for real client names.
Outcome measures	NPRS / PSFS linked to your private labels only.
Client emails	Used once for handout delivery; not saved in the database.
Clinic analytics	Aggregated counts only. No individual client content visible to others.
Annotations	Private to the therapist who created them.

Your Ongoing Responsibilities

Even with a privacy-conscious tool, the treating RMT and clinic remain responsible for:

Obtaining and documenting consent
Maintaining the official clinical record according to CMTO Standards
Secure handling of any information you export or download
Following PHIPA and clinic privacy policies
Referral and communication with other providers as appropriate

Authoritative Resources

CMTO – Standard of Practice: Privacy and Confidentiality
CMTO – Standards of Practice (Assessment, Consent, Documentation)
Information and Privacy Commissioner of Ontario (IPC) – PHIPA guidance
Personal Health Information Protection Act, 2004

This page is educational support only and does not constitute legal advice. Consult CMTO, the IPC, or legal counsel for specific compliance questions.