When you share something personal with a therapist, you’re trusting that it stays between you and them. That trust isn’t just a professional courtesy in Nova Scotia. It’s backed by law. Privacy rights for therapy clients in Nova Scotia are defined by specific legislation, and knowing what those rights are can help you feel more confident walking into a first session, asking questions about your file, or raising a concern if something doesn’t feel right. Three things matter most here: what information your therapist can collect, when they’re allowed to share it, and what you can do if you think your rights have been ignored.
The law behind your privacy rights as a therapy client in Nova Scotia
Your privacy in therapy isn’t protected by a general sense of professional ethics alone. Two pieces of legislation create real, enforceable rights. The first is the Personal Health Information Act, S.N.S. 2010, c. 41, known as PHIA. It came into force on June 1, 2013, and it governs how regulated health care professionals and organizations in Nova Scotia collect, use, disclose, retain, and destroy personal health information. If your therapist is a regulated health professional, PHIA applies to them directly.
The second is PIPEDA, the federal Personal Information Protection and Electronic Documents Act. PIPEDA also applies to commercial health activities, including private psychotherapy practices in Nova Scotia. In practice, this means a private therapy clinic is accountable under both laws simultaneously, and the stricter standard generally wins.
A common misconception is that privacy protection only kicks in if something goes wrong. In reality, both laws require active compliance from the moment your therapist collects your name and reason for seeking help. You don’t have to wait for a breach to have rights. Those rights exist from your very first contact with a clinic.
What counts as personal health information in therapy
Not everything your therapist writes down is automatically protected under PHIA, but the scope is broader than most people expect. Personal health information includes your name, contact details, health history, diagnoses, treatment notes, session content, and anything else that identifies you and relates to your physical or mental health. That means the notes your therapist takes during a session about your sleep patterns, your relationship history, or your trauma background are all covered.
Under PHIA, regulated health professionals in private practice are considered custodians of your information. Their staff, billing contractors, or supervised trainees who handle your file are called agents, and they carry defined obligations too. So if a receptionist books your appointment or an administrative assistant processes your insurance claim, they are legally bound by the same framework as your therapist.
One edge case worth knowing: if you use a third-party telehealth platform or an online booking system, the data you enter there may be governed by that platform’s own privacy policy in addition to your therapist’s obligations. It’s worth asking your clinic which platforms they use and whether those platforms are compliant with Canadian privacy law. A clinic that can’t answer that question clearly is worth pressing further.
When your therapist can share your information without asking you first
Confidentiality in therapy is real, but it isn’t absolute. There are specific situations where your therapist is legally permitted, or even required, to share information without your consent. Understanding these exceptions before you start therapy is more useful than being surprised by them later.
Mandatory reporting and duty to warn
Nova Scotia law requires regulated professionals to report certain situations regardless of client consent. These include reasonable suspicion of child abuse or neglect, and situations where a client poses a serious and credible risk of harm to an identifiable person. These aren’t discretionary calls left entirely to the therapist’s judgment. They are legal obligations.
Treatment team disclosures
If your therapist is coordinating care with your family doctor, a psychiatrist, or another provider, they may share relevant information with those providers under the treatment exception in PHIA. This doesn’t require your explicit consent each time, but it does require that the disclosure be for the purpose of providing or assisting in providing health care to you. Sharing your file with your employer, your insurance company, or a family member who asks does not fall under this exception. Those disclosures require your written consent.
The practical takeaway: ask your therapist at the start of treatment who else might see your information and under what circumstances. A good therapist will welcome that question.
Your right to access and correct your therapy records in Nova Scotia
One of the most underused rights clients have is the right to see their own records. Under PHIA, you can request access to your personal health information held by your therapist or clinic. This includes session notes, intake forms, assessments, and correspondence related to your care.
There is a specific process for corrections as well. Under PHIA, if you believe information in your file is inaccurate or incomplete, you can request a correction in writing. The custodian, meaning your therapist or their clinic, must respond in writing within 30 days. They can accept the correction, or they can decline it, but if they decline, they must note your request in your file so that anyone who later sees the record knows you disputed it.
A common assumption is that therapy notes are too subjective to correct. That’s not quite right. If a note contains a factual error, such as the wrong date, a misquoted statement, or an incorrect medication listed, you have grounds to request a correction. What you generally cannot do is demand that a therapist change their clinical interpretation or professional opinion. The distinction matters: facts versus clinical judgment.
If you want to understand more about how records and billing work at Wholetherapy, the FAQ page covers common questions about how client information is handled.
How therapy notes are stored, retained, and eventually destroyed
Your file doesn’t disappear when therapy ends. PHIA requires that personal health information be retained for a minimum period after the last date of service, and that it be destroyed in a secure manner when that period has passed. For adult clients, records are typically retained for a number of years after the last contact. For clients who were minors at the time of treatment, the retention period is generally longer, often extending until the person reaches adulthood plus an additional period.
Secure destruction matters. A therapist who simply throws paper notes in a recycling bin or deletes a digital file without proper data wiping is not meeting their obligations under PHIA. Proper destruction means shredding paper records and using secure deletion methods for electronic files so that the information cannot be recovered.
Electronic records introduce additional considerations. If your clinic uses an electronic health record system, that system should have access controls, audit logs, and encryption. You’re entitled to ask whether your records are stored on Canadian servers, since data stored outside Canada may be subject to foreign laws that override your Canadian privacy protections. This is a real concern with some U.S.-based practice management platforms, and it’s a fair question to raise with any clinic you’re considering.
What to do if you think your privacy rights have been violated
If you believe your personal health information has been collected, used, or shared in a way that violates PHIA or PIPEDA, you have options. The first step is usually raising the concern directly with the clinic. Many privacy issues are the result of administrative errors rather than deliberate violations, and a well-run clinic will take your concern seriously and investigate it.
If that doesn’t resolve the issue, you can file a complaint with the Office of the Information and Privacy Commissioner of Nova Scotia, which oversees PHIA compliance. For concerns that fall under PIPEDA, the federal Privacy Commissioner of Canada handles complaints. You do not need a lawyer to file a complaint with either office, and the process is designed to be accessible to individuals.
One thing to know: filing a complaint does not automatically mean your therapist will be disciplined or that you’ll receive compensation. The Commissioner’s role is primarily to investigate and make recommendations. If your concern also involves professional misconduct, you may want to contact the relevant regulatory college for your therapist’s profession separately. The two processes are independent of each other.
If you have specific questions about how Wholetherapy handles client information, you’re welcome to contact us directly before booking.
Practical privacy questions to ask before your first therapy session
Knowing your rights in the abstract is useful. Knowing what to actually ask a clinic before you start is more useful. Most people don’t ask any privacy-related questions before their first session, partly because it feels awkward and partly because they don’t know what to ask. Here are the questions that matter most.
Questions worth asking any therapy clinic in Nova Scotia
- What privacy legislation governs how you handle my information?
- Who else in your clinic might have access to my file?
- Do you use any third-party platforms for booking, billing, or video sessions, and are they compliant with Canadian privacy law?
- How long do you retain client records after treatment ends?
- What is your process if there is a privacy breach?
- Do you share information with insurance companies, and if so, what do you share?
A therapist who answers these questions clearly and without defensiveness is demonstrating that they take their obligations seriously. Vague or dismissive answers are worth paying attention to. You’re not being difficult by asking. You’re exercising exactly the kind of informed consent that good clinical practice is built on.
Wholetherapy offers EMDR therapy and other trauma-focused services in Dartmouth, Nova Scotia. If you’re weighing your options and want to understand how the clinic approaches client privacy before booking, the FAQ is a good starting point, or you can reach out directly.
Frequently asked questions
What privacy laws protect therapy clients in Nova Scotia?
Two laws apply. The Personal Health Information Act (PHIA), S.N.S. 2010, c. 41, is Nova Scotia’s provincial health privacy law and came into force on June 1, 2013. It governs how regulated health professionals collect, use, disclose, retain, and destroy your personal health information. PIPEDA, the federal Personal Information Protection and Electronic Documents Act, also applies to private therapy practices operating commercially in Nova Scotia. Both laws create enforceable rights, and your therapist must comply with both.
Can my therapist share what I say in sessions with anyone?
Generally, no. What you share in therapy is confidential. There are specific exceptions: mandatory reporting of suspected child abuse, situations involving a credible risk of serious harm to an identifiable person, and disclosures to other members of your treatment team for the purpose of providing your care. Outside of those exceptions, your therapist needs your written consent before sharing your information with anyone, including your family, your employer, or your insurance company.
Do I have the right to see my own therapy records in Nova Scotia?
Yes. Under PHIA, you have the right to request access to your personal health information held by your therapist or clinic. You can also request a correction if you believe something in your file is factually inaccurate. The clinic must respond to a correction request in writing within 30 days. If they decline to make the correction, they must note your request in your file so the dispute is on record.
What happens to my therapy records after I stop seeing my therapist?
Your records are retained for a minimum period after your last date of service, as required by PHIA. The exact retention period depends on your age at the time of treatment and the applicable professional standards for your therapist’s regulatory college. After the retention period ends, records must be destroyed securely, meaning shredded for paper records and properly wiped for electronic files. You can ask your clinic about their specific retention and destruction policies before you start.
What can I do if I think my privacy rights as a therapy client were violated?
Start by raising the concern directly with the clinic, since many issues stem from administrative errors that can be corrected. If that doesn’t resolve things, you can file a complaint with the Office of the Information and Privacy Commissioner of Nova Scotia for PHIA-related concerns, or with the federal Privacy Commissioner of Canada for PIPEDA-related concerns. Neither process requires a lawyer. If your concern also involves professional misconduct, contact the relevant regulatory college for your therapist’s profession separately, as that is a distinct process from a privacy complaint.