When you sit down with a therapist for the first time, you’re sharing things you may never have told anyone. That takes trust. Part of that trust depends on knowing your information is protected, not just by your therapist’s ethics, but by law. Privacy rights for therapy clients in Nova Scotia are governed by specific legislation, and understanding what those rights actually mean in practice can make a real difference in how comfortable you feel opening up. Three things shape this more than most people expect: which law applies to your situation, what your therapist is actually required to do, and where the limits of confidentiality sit.
The law behind your privacy rights as a therapy client in Nova Scotia
Nova Scotia has its own health privacy legislation: the Personal Health Information Act, S.N.S. 2010, c. 41, known as PHIA. It came into force on June 1, 2013, and it is the primary law governing how your personal health information is handled by regulated health professionals in this province. PHIA covers how your information is collected, used, disclosed, retained, and eventually destroyed.
What counts as personal health information? It includes anything that identifies you and relates to your physical or mental health, the services you receive, your health history, or your health care payments. In a therapy context, that means your session notes, your intake forms, your diagnosis if one is recorded, and even the fact that you are a client at all.
There is also a federal layer. The Personal Information Protection and Electronic Documents Act, commonly called PIPEDA, applies to commercial health activities in Nova Scotia, including private psychotherapy practices. So if you are seeing a therapist in a private clinic, both PHIA and PIPEDA may apply. The two laws overlap in many areas, but PHIA is the more specific and detailed framework for health information in this province. When there is a conflict, PHIA generally takes precedence for regulated health professionals operating in Nova Scotia.
This dual-layer structure surprises many people. Most assume there is one law and one regulator. In practice, your therapist may need to satisfy obligations under both.
Who is responsible for protecting your personal health information
Under PHIA, the person or organization responsible for your information is called a “custodian.” In a private therapy practice, the regulated health professional running the practice is the custodian. Anyone working on their behalf, such as administrative staff, billing contractors, or supervised therapists, is called an “agent.” Both custodians and agents have defined legal obligations under PHIA.
This matters practically. If a receptionist at a clinic shares your appointment information with someone who calls asking about you, that is not just an ethical breach. It is a potential violation of PHIA. The custodian, meaning the therapist or clinic owner, is accountable for ensuring their agents handle your information properly.
What this means for group practices and clinics
In a group practice, multiple therapists may share administrative systems, billing software, or even office space. Your information should only be accessible to the people directly involved in your care. A therapist at the same clinic who is not your provider should not have access to your file simply because they work in the same building. If you are ever unsure about who can see your records at a clinic, you have the right to ask.
At Wholetherapy, questions about how your information is handled can be directed to the clinic directly. The FAQ page covers some common questions about how the practice operates.
What your therapist can and cannot share without your consent
Confidentiality is one of the foundational principles of therapy, and most people know that what they say in a session stays in the room. But the limits of that confidentiality are less well understood, and they matter.
Your therapist cannot share your personal health information with your employer, your family members, your insurance company, or anyone else without your consent, with specific exceptions. Those exceptions exist in law, not just in professional ethics codes, and they include situations where disclosure is required to prevent serious harm to you or someone else, where a court orders it, or where another law requires it.
The limits most clients don’t ask about
A few situations catch people off guard:
- Insurance claims: If you submit a claim to your insurance provider, you are authorizing some disclosure of your information to that company. The scope of what gets shared depends on your policy and what you sign. Read those authorization forms carefully before submitting.
- Court orders: If your therapy records are subpoenaed as part of legal proceedings, your therapist may be legally required to produce them, even if you object. This comes up more often than people expect in family law and custody cases.
- Mandatory reporting: Therapists in Nova Scotia have legal obligations to report certain things, including reasonable suspicion of child abuse or neglect. This is not a discretionary call. It is a legal requirement.
None of these exceptions mean your therapist is looking for reasons to share your information. They mean that confidentiality, while strong, is not absolute. A good therapist will explain these limits at the start of treatment, usually in an informed consent document.
Your right to access and correct your therapy records in Nova Scotia
One of the most underused rights clients have is the right to see their own records. Under PHIA, you can request access to your personal health information, and your therapist or clinic is required to respond. You also have the right to request a correction if you believe something in your record is inaccurate or incomplete.
The correction process has a specific timeline built into the law. If you submit a written request for a correction, the custodian must respond in writing within 30 days. They do not have to make the correction if they disagree with your assessment, but they must acknowledge your request and explain their decision. If they decline, you have the right to have a statement of disagreement added to your file.
This is not a commonly used right, but it is a meaningful one. Consider a situation where a client’s intake notes contain a factual error about their medical history, something that could affect how future providers interpret their file. Knowing you can flag and formally dispute that error is genuinely useful.
Accessing your records is not always straightforward. Some therapists use clinical language or shorthand that can be hard to interpret without context. You are entitled to ask for an explanation of what you are reading. You are also entitled to a copy, though the clinic may charge a reasonable fee for producing it.
How your information is stored, retained, and eventually destroyed
PHIA does not just govern what happens to your information while you are in treatment. It also covers what happens after. Custodians are required to retain your records for a minimum period, and they must eventually destroy them in a way that protects your privacy. Simply deleting a digital file or tossing paper records in a recycling bin does not meet the standard.
The retention period for adult clients is generally tied to professional regulatory requirements, which vary by profession. For many regulated health professionals in Nova Scotia, records must be kept for a minimum of ten years from the date of the last service, or until a minor client turns nineteen, whichever is longer. If you are unsure how long your records will be kept, ask your therapist directly. They should be able to tell you.
Digital records introduce additional considerations. Therapy notes stored in cloud-based practice management software, for example, may be hosted on servers outside Nova Scotia or even outside Canada. PHIA has provisions about transferring personal health information outside the province, and your therapist should have a data storage policy that addresses this. If you are concerned about where your records are stored, that is a reasonable question to raise before your first session.
Wholetherapy uses secure systems for record-keeping. If you have specific questions about data storage, contact us directly.
Privacy rights in telehealth and online therapy sessions
Online therapy has become a standard option for many clients in Nova Scotia, particularly for people in rural or remote areas of Atlantic Canada where in-person services may be limited. The same privacy laws apply whether your session happens in a physical office or over a video call, but the practical risks are different.
Your therapist is responsible for using a secure, encrypted platform for video sessions. A standard consumer video call app does not meet the standard. But your side of the connection matters too. If you are taking a session from a shared living space, a parked car, or a workplace, the risk of being overheard is real. Your therapist cannot control your environment, but a good one will ask about it and help you think through your options.
There is also the question of what happens to session recordings. Some platforms record by default. Your therapist should not be recording your sessions without your explicit, informed consent. If you are ever unsure whether a session is being recorded, ask before you start.
For clients considering EMDR therapy delivered online, there are additional considerations around the bilateral stimulation components of the treatment. Those are clinical questions as much as privacy ones, and worth discussing with your therapist before you begin.
What to do if you think your privacy rights have been violated
If you believe your personal health information has been mishandled, you have options. The first step is usually to raise the concern directly with your therapist or the clinic. Many issues stem from misunderstandings or administrative errors, and a direct conversation can resolve them quickly.
If that does not resolve the issue, you can file a complaint with the Nova Scotia Office of the Information and Privacy Commissioner (OIPC). The OIPC has the authority to investigate complaints under PHIA and can require a custodian to take corrective action. You do not need a lawyer to file a complaint, and there is no fee.
You may also have recourse through your therapist’s professional regulatory body. Regulated therapists in Nova Scotia belong to professional colleges that have their own complaint processes and codes of conduct. A privacy breach can be both a legal issue under PHIA and a professional conduct issue under a regulatory college’s standards.
One thing to keep in mind: not every uncomfortable disclosure is a legal violation. If your therapist shared information with another provider involved in your care, that may be permitted under PHIA even without your explicit consent in some circumstances. The distinction between a permitted disclosure and a breach is not always obvious, which is why the OIPC exists as an independent body to make that determination.
If you have questions about how Wholetherapy handles your information, the FAQ is a good starting point, or you can contact us to speak with someone directly.
Frequently asked questions
What privacy rights do therapy clients have in Nova Scotia?
Therapy clients in Nova Scotia have the right to have their personal health information collected, used, and disclosed only in ways permitted by the Personal Health Information Act (PHIA). This includes the right to know why your information is being collected, the right to access your own records, and the right to request corrections to inaccurate information. You also have the right to file a complaint with the Nova Scotia Office of the Information and Privacy Commissioner if you believe your information has been mishandled. These rights apply whether you are seeing a therapist in person or online.
Can my therapist share my information with my family or employer in Nova Scotia?
No. Your therapist cannot share your personal health information with your family members, employer, or anyone else without your consent, except in specific circumstances defined by law. Those exceptions include situations involving serious risk of harm, mandatory reporting obligations such as suspected child abuse, and court orders. Outside of those exceptions, your information stays between you and your provider. If you are ever asked to sign a release of information form, read it carefully before you do.
How long does a therapist in Nova Scotia keep my records?
The retention period for therapy records in Nova Scotia is generally tied to professional regulatory requirements, and for many regulated health professionals it is a minimum of ten years from the date of the last service. For clients who were minors at the time of treatment, records are typically kept until the client turns nineteen, or for ten years from the last service, whichever is longer. After the retention period ends, records must be destroyed in a way that protects your privacy. If you want to know the specific retention policy at your clinic, ask your therapist directly.
What are my privacy rights in therapy in Nova Scotia if I use online sessions?
Your privacy rights in therapy in Nova Scotia are the same whether your sessions happen in person or online. Your therapist is required to use a secure, encrypted platform for video sessions and should not record sessions without your explicit consent. The main practical difference is that you are responsible for your own environment: taking a session in a private space where you cannot be overheard is your responsibility, not your therapist’s. If you have concerns about the platform being used or how your session data is stored, raise them before your first online appointment.
What should I do if I think my therapist violated my privacy in Nova Scotia?
Start by raising the concern directly with your therapist or clinic, since many issues can be resolved through a direct conversation. If that does not resolve it, you can file a complaint with the Nova Scotia Office of the Information and Privacy Commissioner, which investigates complaints under PHIA at no cost to you. You may also have the option of filing a complaint with your therapist’s professional regulatory college if the breach also involves a professional conduct issue. Keep in mind that not every disclosure is a violation, so an independent review can help clarify whether your rights were actually breached.