Client Record Access Requests: A 2026 Guide for Canadian Therapists

A request for access to a clinical record should not be treated as an awkward administrative interruption. It is the exercise of an important privacy right. For a private psychologist, social worker, psychotherapist, or regulated counsellor, the task is to make a client’s personal information available while protecting third-party privacy, safety, and the integrity of the record.

This is a practical Canadian workflow, not legal advice. Provincial health-privacy rules, professional standards, and the practitioner’s role can change the answer in a difficult case. Where there is a safety concern, court process, child-protection issue, insurer involvement, or a disputed capacity question, obtain advice from the relevant regulator, insurer, or counsel promptly.

Start with the right distinction: access to information is not an unreviewed file export

In Quebec, the private-sector privacy law gives an individual a right to be informed about and access personal information held about them, subject to specific exceptions. The Commission d’accès à l’information (CAI) explains the access and rectification process for individuals. Federally, PIPEDA gives individuals a comparable right to access personal information held by organizations in commercial activities. Ontario’s PHIPA governs personal health information in the custody or control of health information custodians, and British Columbia’s PIPA applies to many private organizations.

A client may request intake material, progress notes, assessments, correspondence held in the chart, invoices, or other personal information. That does not always mean every original document can be released unchanged. A record may contain another person’s information, material received under conditions, information protected by legal privilege, or content for which a statutory exception applies. The answer is an informed access decision—not simply pressing “download all.”

Receive the request, verify identity, and define its scope

Written requests are usually the safest operational choice, even where a form is not mandatory. They establish what was requested, when it arrived, the requested period, preferred format, and delivery channel. A request by email may be acceptable when identity is established, but a message from an unfamiliar address should never trigger release of health information.

Use a proportionate identity check. For an existing client, confirmation through the known client portal, a callback to the number in the chart, or a verified existing email may be enough. For a former client, a representative, or a request involving highly sensitive records, stronger verification may be appropriate. Collect only what is necessary; a privacy process should not create a new pile of unnecessary identity documents.

An efficient intake sequence looks like this:

Acknowledge receipt and record the received date.
Confirm identity and, if relevant, a representative’s authority.
Clarify whether the client seeks the entire chart, a date range, a report, billing records, or a correction.
Create an administrative tracking entry with the deadline, reviewer, decision, and delivery method.

Parents, partners, lawyers, insurers, and employers are not automatically entitled to a client’s record. A family relationship does not prove authority. For a minor or incapable adult, verify the legal authority and apply the rules of the relevant province and professional college.

Put the deadline on the calendar immediately

Under Quebec’s private-sector law, an enterprise generally has 30 days to respond to an access request, with a possible extension in defined circumstances if the person is notified within the original period. PIPEDA also generally requires a response within 30 days, with limited extensions and written notice. The applicable provincial regime may add requirements, especially for health information.

The practical lesson is simple: calculate the deadline as soon as the request is received. A busy calendar, an archived chart, staff absence, or an unmonitored inbox does not make the request disappear. If additional time is legally available because of volume, conversion work, consultation, or difficulty locating records, give the required written notice before the initial deadline. Do not wait until the final week to decide whether a review is complex.

Review the record before disclosure

Create a working copy and review each item. This is a quality-control step, not a reason to delay access. Look for:

personal information about a family member, another client, or an informant;
reports or communications from another professional and any applicable conditions;
scheduling or administrative entries that identify someone else;
material tied to litigation, an investigation, or insurance processes;
information where a statutory safety or other exception may genuinely apply.

Technical language, an unflattering clinical observation, or the possibility that a client will ask questions are not blanket grounds to withhold information. Privacy regulators expect a case-by-case analysis. Where only a portion requires protection, redact that portion and release the balance when possible. Preserve the original chart; record what was withheld or redacted, why, and under what authority.

Correction requests require a separate mindset. A client may identify a factual error, ask to have their view added, or disagree with a professional interpretation. Do not silently rewrite a signed clinical note and erase the record’s history. Make a dated, attributable addendum for a correction, or attach a statement of disagreement where the applicable law provides for it. A transparent audit trail protects both continuity of care and the practitioner.

Deliver the copy securely and accessibly

Ordinary email is convenient, but it is not automatically suitable for a full clinical record. Consider sensitivity, volume, the client’s capacity to use the delivery method, and the risk of an address error. A client portal with authentication, an expiring encrypted link, a password-protected PDF with the password shared separately, or verified in-person collection will often be more appropriate. For paper delivery, verify the address and avoid leaving documents in an unsecured place.

Respect reasonable format preferences. The client should receive a legible, usable copy. If notes contain acronyms or structured shorthand, a brief explanation of the format or an offer to review the material can be helpful. For sensitive content, a practitioner may recommend a supported review. That recommendation should not become a routine barrier to access.

Fees, partial refusals, and a clear written response

Fee rules vary by jurisdiction. Under PIPEDA, charges must be minimal and the individual must be informed before costs are incurred. Quebec practitioners should confirm the applicable rules with the CAI and their professional order. In every setting, transparency is the practical standard: disclose any permitted fee before producing the copies, and keep the communication record.

If information is withheld or redacted, the written response should identify the affected category, explain the legal basis in understandable language, and state available complaint or review options. “The chart is confidential” is not a sufficient explanation—the chart is confidential precisely because it concerns the client. For a difficult safety assessment or legal exception, seek timely professional advice rather than inventing a broad exemption.

Turn the process into a one-page practice procedure

A short written procedure reduces stress and prevents missed steps. It can include a receipt template, identity-verification checklist, deadline tracker, third-party review guide, and templates for release, extension, and partial-refusal notices. If an administrative assistant helps, assign roles deliberately. Delegation does not transfer the practitioner’s confidentiality obligations.

Practice-management software can support the workflow with role-based access, document organization, activity logs, and secure sharing. Software does not decide whether a particular page may legally be released; that remains a professional decision based on the record and the governing law. FYL.care helps private practices organize client documents and administrative exchanges in one place.

Less administrative back-and-forth, more control. Gratuit. Sans carte de crédit. Pour toujours.

Pre-release checklist

The requester’s identity—and any representative’s authority—has been verified.
The request date and response deadline are recorded.
Relevant current and archived records have been located.
Third-party information and possible exceptions have been individually reviewed.
Any redaction is documented without changing the original note.
The delivery method is secure and confirmed with the client.
The response explains any permitted fee, limitation, and review route.
The tracking record shows what was sent, when, and by whom.

Primary sources

FAQ

Does a therapist have to release every raw progress note?

Not always. The client has access rights to their personal information, subject to legal exceptions. Third-party information or a justified exception may require a partial refusal or redaction. The review should be documented.

How long does a therapist have to respond?

Quebec and PIPEDA generally start from a 30-day response period. Extensions can be available in limited cases, but the required written notice must be provided on time. Check provincial health-privacy rules as well.

Can a clinical record be sent by email?

Only after assessing the risk and using appropriate safeguards. An authenticated portal, encrypted link, or protected document is often safer than an ordinary email attachment.

What if a client disagrees with a note?

Review the issue, correct factual errors through a traceable addendum, and add the client’s statement of disagreement where applicable. Do not quietly erase the original clinical record.