Secure Patient Portal in 2026: A Law 25 and PIPEDA Guide for Therapists

A patient portal can simplify booking, intake forms, secure messages, receipts, and document sharing. But a product does not become secure merely because it is called a “portal.” For a private practice, the useful question is whether the service helps protect personal information, control access, and respond to client requests and privacy incidents.

In Quebec, Law 25 modernized private-sector privacy rules and strengthened governance, security, and incident obligations. Across Canada, PIPEDA is built around accountability, identifying purposes, consent, limiting collection, safeguards, openness, and individual access. Provincial laws may also apply, such as PHIPA in Ontario or PIPA in British Columbia.

This guide gives psychologists, social workers, psychotherapists, counsellors, coaches, and other independent practitioners a practical way to evaluate and deploy a portal in 2026. It is an operations guide, not legal advice; confirm the requirements of the relevant regulator and province.

1. What a patient portal can—and cannot—solve

A portal is an authenticated space where a client can access or submit information. Depending on the vendor, it may include appointments, intake forms, documents, payments, messaging, or telehealth.

Its main benefit is replacing scattered email and text-message exchanges with a more controlled workflow. A unique client account, explicit permissions, and an authenticated session are easier to govern than a shared inbox. A portal does not automatically fix:

collecting more information than the service requires;
weak passwords, missing multi-factor authentication, or long-lived sessions;
overly broad staff or vendor access;
unknown backups, subprocessors, or cross-border transfers;
the absence of an incident-response process;
sending the wrong document to the wrong client.

Security is therefore a combination of technology, configuration, and daily practice.

2. Turn privacy requirements into operating decisions

Quebec’s Commission d’accès à l’information states that private organizations must take security measures to protect personal information they collect, use, communicate, retain, or destroy. For a portal, the practice should be able to explain why each category of information is collected, who can see it, and how long it is retained.

Law 25 also reinforces organizational accountability. A solo practice is not exempt because it has fewer clients: the volume is smaller, but clinical information remains sensitive. Before choosing a vendor, document at least:

the portal’s purposes: booking, forms, messages, documents, or payment;
the information needed for each purpose;
the people and service providers who can access it;
the risks created by the portal and its integrations;
retention and secure-destruction rules;
the response plan for a privacy incident.

Under PIPEDA, the Office of the Privacy Commissioner of Canada describes accountability as a core principle: an organization remains responsible for personal information entrusted to a service provider. A vendor contract does not transfer the whole responsibility. The practice must review the safeguards promised and oversee how they are used.

3. Questions to ask the portal vendor

Marketing copy is not enough. Request specific answers, preferably in security documentation, a data-processing agreement, or the contract.

Where is the information hosted?

Ask for hosting regions, countries, subprocessors, and cross-border transfers. Hosting outside Canada or Quebec is not automatically prohibited in every situation, but it can affect the risk assessment, client notice, and contractual safeguards. Quebec practices should review the rules that apply before communicating personal information outside Quebec.

How are accounts and sessions protected?

Check for multi-factor authentication, password controls, automatic logout, session management, role-based permissions, and immediate user removal. Every team member should have an individual account. Even in a solo practice, vendor support access should be limited, justified, and traceable.

What activity is logged?

A useful portal should make it possible to identify who viewed, changed, exported, or deleted a record. Ask how long logs are retained and whether the practice can retrieve them for an investigation. Without meaningful audit trails, it is difficult to detect an error or answer a client’s question.

What happens when the contract ends?

The vendor should explain how records can be exported in a usable format, how quickly production copies are deleted, and how backups are handled. A service that makes retrieval impractical creates a continuity risk and excessive dependence on the vendor.

How are incidents reported?

Ask about notification timelines, the contact point, the information supplied, and the vendor’s help with containment and investigation. In Quebec, an incident that presents a risk of serious harm must be assessed, documented, and handled under the applicable rules. The practice should not learn about a serious problem only through a client or a news report.

Explain the portal in plain language. The privacy notice and client information should describe the purposes, categories of information, recipients, service providers, and how to request access or correction.

Consent is not a sentence hidden in general terms. Separate communications needed to deliver the service from optional uses such as marketing. Collect the minimum information needed for each step. An appointment-request form usually does not need a detailed clinical history; adding sensitive fields creates risk without improving scheduling.

Prepare an alternative channel as well. A client may not have a smartphone, stable internet, or the ability to use a particular portal. Offering another secure method improves accessibility without forcing the person to disclose sensitive information through an unsuitable channel.

5. A private-practice deployment checklist

Before activating a portal, confirm that:

After launch, review the portal quarterly: active accounts, permissions, integrations, vendor updates, incidents, and client requests. Portal security often deteriorates through small changes—a former staff account, an unused integration, or a form that gradually collects more than the practice needs.

6. Patient portal versus practice-management software

A portal is a client-facing interface. Practice-management software also organizes records, appointments, billing, tasks, and documents for the professional. The two may be integrated, but they are not the same product.

Start with the actual workflow: what must the client submit, who checks it, where is it stored, and who uses it next? An independent portal may solve online booking while leaving records in another system, creating exports and duplicate copies. An integrated platform may reduce duplication, provided its access controls and retention settings are sufficiently detailed.

Price should not be the only criterion. Compare total cost, optional modules, migration, support, exportability, and the time required to fix routing errors. A free tool can be appropriate if its functions match the need and its privacy practices are documented; a paid product is not automatically compliant.

FAQ

Is a patient portal mandatory for therapists?

No. Privacy obligations concern how information is protected and managed, not the purchase of one specific portal. A portal can nevertheless reduce some risks by replacing scattered communications with a controlled workspace.

Must patient-portal data be hosted in Canada?

Not in every situation. The practice must assess location, applicable laws, vendor access, transfers, and contractual safeguards. Quebec practices should specifically review the requirements that apply to communications outside Quebec.

Can a portal be used to send clinical notes?

Only where the sharing is necessary, authorized, and appropriately protected. Limit the content, verify the recipient, and document the disclosure. Professional clinical records and a client’s personal copy should not be treated as the same thing.

What if a vendor will not disclose its subprocessors?

Treat the lack of transparency as a governance risk. Request written documentation or choose a provider that gives enough information to evaluate where sensitive data goes and who can access it.

Does FYL.care replace a privacy compliance assessment?

No. FYL.care can help organize a practice, but the professional remains responsible for choices, settings, client notices, and professional obligations.

Conclusion

A secure patient portal is not just a login page; it is a governed process. Define the purposes, minimize collection, assess the vendor, protect access, plan the exit, and rehearse an incident response.

Free. No credit card. Forever. Explore FYL.care, practice-management software for psychologists, social workers, therapists, and coaches.