A public website is not a clinical system, and it should not behave like one. The simplest way to stay safe is to collect as little as possible and keep health details out of the site entirely.
Know which rules may apply
Privacy law for health practices in Canada is layered. Depending on your province and how your practice is organized, rules can include the federal PIPEDA, provincial health information laws (such as Ontario's PHIPA or Alberta's Health Information Act), British Columbia's PIPA, and Quebec's private-sector privacy law as modernized by Law 25. Your regulatory college may also publish its own expectations. Ask your college or a privacy professional which apply to you.
What forms should and should not collect
- Collect: name, phone or email, preferred contact method, and a general reason such as "new patient" or "booking question".
- Do not collect: symptoms, diagnoses, medications, health card numbers or anything clinical. Add a visible line on the form telling visitors not to send health details.
Email is not a safe place for patient information
Standard email is not a secure channel for health information. Have form submissions notify staff that a message exists, then follow up by phone or through your secure system rather than copying the patient's message into email.
Analytics, cookies and ad pixels
Marketing pixels and some analytics tools can send information about what a visitor viewed to third parties. On a health site, that browsing information can itself be sensitive: a visit to a page about a specific condition says something about the visitor. Use privacy-respecting analytics, avoid advertising pixels on service pages, and give visitors a clear cookie notice where one is required. Quebec's law, in particular, sets stricter expectations around consent.
Booking and intake tools
When you connect a third-party booking system, you are choosing where patient information is stored. Ask the vendor where data is hosted, how it is protected, and what their privacy commitments are, and make sure your privacy policy names the tool.
Your privacy policy
It should say what you collect through the site, why, who can see it, how long you keep it, and how a person can contact you with questions. Write it in plain language, and have it reviewed against your own obligations.
This guide is general information for practice owners, not legal advice. Rules differ by profession and province, so confirm anything important with your regulatory college or a qualified advisor.
