---
title: "PHIPA: What Your Clinic Website Form Can Collect"
description: "What PHIPA means for a clinic contact or booking form: collect the minimum, keep health details off the site. General information, not legal advice."
category: "Clinics"
question: "Can a clinic contact or booking form be PHIPA-compliant?"
datePublished: 2026-10-15
dateModified: 2026-10-15
readingMinutes: 6
status: published
author: "UXPro Design Studio"
authorType: "Organization"
editorialProcess: "Prepared with AI assistance and checked against the listed sources."
authorUrl: https://uxpro.ca/about
canonical: https://uxpro.ca/blog/phipa-clinic-website-forms
image: https://uxpro.ca/covers/phipa-clinic-website-forms.webp
license: "Quote freely with a link to the canonical URL."
---

# PHIPA: What Your Clinic Website Form Can Collect

## Key facts

| Fact | Value |
|---|---|
| What PHIPA is | Ontario's Personal Health Information Protection Act, 2004 |
| Who it regulates | Health information custodians, including health care practitioners and group practices, plus their agents and electronic service providers |
| The rule that shapes a form | A custodian may not collect more personal health information than is reasonably necessary (s. 30) |
| Where booking belongs | Your practice-management or booking system, not a separate website form |
| Data residency | PHIPA does not require storage in Ontario or Canada; disclosure outside Ontario is limited by s. 50 (IPC FAQ) |

**Yes, if the form collects only what is needed to start a conversation and never asks for symptoms, diagnoses, medications or health card numbers. PHIPA bars a clinic from collecting more personal health information than is reasonably necessary, and a contact form does not need clinical detail. Anything clinical belongs in your booking or EMR system, which keeps most of the PHIPA risk off your website.**

## What does PHIPA cover?

Ontario's [Personal Health Information Protection Act, 2004](https://www.ontario.ca/laws/statute/04p03) ([PHIPA](/glossary#phipa)), consolidated on 1 January 2026, governs how "health information custodians" collect, use, disclose and protect personal health information. As of 15 October 2026, the sections that matter for a clinic website are:

| Section | What it says, in short |
|---|---|
| s. 3 | A health information custodian includes a health care practitioner or a person who operates a group practice of health care practitioners, when they have custody or control of personal health information because of that work. |
| s. 4 | Personal health information is identifying information, oral or recorded, that relates to a person's physical or mental health, to the health care provided to them (including identifying their provider), to payment or eligibility for care, or that is their health number. |
| s. 29 | A custodian may not collect, use or disclose it without consent, unless the Act permits or requires it. |
| s. 18 | Consent may be express or implied, with exceptions; s. 20 lets certain custodians assume implied consent when providing health care. |
| s. 30 | A custodian may not collect personal health information if other information will serve the purpose, or collect more than is reasonably necessary. |
| s. 12 | A custodian takes reasonable steps to protect it against theft, loss and unauthorized use or disclosure. |
| s. 17 | A custodian is responsible for personal health information in its custody or control, including what its agents do with it. |

The practical question for a website is "does this form collect personal health information, and does it need to?" Section 30 answers the second half for most fields.

## What can a clinic website form safely ask for?

Keep every public form on the marketing side of a clear line. A name, a way to reply and a general reason for contact are usually enough to book a call. When a field asks someone to describe symptoms, list medications, confirm a diagnosis or enter a health card number, the form is collecting personal health information it does not need, and the systems behind it (form plugin, inbox, spreadsheet) now hold it.

| Form field | On a public website form? | Where it belongs instead |
|---|---|---|
| Name, email, phone | Yes, with access to submissions limited to staff who need them | — |
| "New patient" or "existing patient" | Yes | — |
| General reason ("general enquiry", "consultation") | Yes, kept general | — |
| Symptoms or a detailed reason for the visit | No | The booking system's secure intake, or a phone call |
| Medications, diagnoses, allergies | No | The EMR, collected by clinical staff |
| Health card (OHIP) number | No | The booking or EMR system only |

Even the "yes" rows are not automatically outside PHIPA. Section 4 includes information that identifies someone as a person's health care provider, so a message from an existing patient to their clinic can be personal health information. That is a reason to limit who can read submissions, not a reason to add fields.

Apply the same test to any field added after launch: does it need to sit on the website's systems before a patient relationship exists, or can it wait for the booking system?

## Who else becomes responsible when a form collects health information?

A marketing site is often built and maintained by someone other than the clinic's EMR vendor: a web studio, a freelancer, a form plugin. That is fine while the form collects nothing clinical. Once it does, two rules engage:

1. **Agents (PHIPA s. 17).** A person who handles personal health information on the clinic's behalf is its agent, and the clinic remains responsible for what the agent does with it.
2. **Electronic service providers ([O. Reg. 329/04 s. 6](https://www.ontario.ca/laws/regulation/040329)).** A person who supplies services that let a custodian collect or store personal health information electronically, without being its agent, may use the information only as needed to provide the service, may not disclose it, and must bind its own staff to the same restrictions.

The IPC's [PHIPA FAQ](https://www.ipc.on.ca/sites/default/files/legacy/2015/11/phipa-faq.pdf) describes both roles. A web vendor with access to form submissions is in one of them, often without either side having agreed to it.

## Where should booking happen?

In your practice-management system: Jane, Cliniko or whatever you already use. Link to or embed that system's own booking flow rather than building a parallel "request an appointment" form that collects overlapping information in a second place. We cover the link-versus-embed decision in [choosing online booking for a small clinic](/blog/clinic-online-booking). One booking system means one patient record and one place your safeguards have to work.

## What about email and spreadsheets?

The common failure is not a hacked database. It is a form notification forwarded to a personal inbox, or a shared spreadsheet of "who called about what". The IPC's [email fact sheet](https://www.ipc.on.ca/sites/default/files/legacy/2016/09/Health-Fact-Sheet-Communicating-PHI-by-Email-FINAL.pdf) sets out what it expects of custodians that use email:

- Encrypt where you can; many booking and EMR systems include encrypted messaging.
- Before using unencrypted email with patients, notify them of a written email policy and get their consent. The fact sheet gives limiting unencrypted email to appointment scheduling as one example.
- Send from professional accounts, not personal ones, which may have weaker security.
- Collect and send only the minimum information needed.

A spreadsheet that holds health information needs the same access controls as your EMR.

## What consent wording should a clinic form use?

Put a short line at the point of submission, not only in a linked policy: what the form is for, and what not to include. For example: "This form is for booking enquiries only. Please don't include health information; our team will follow up through our secure booking system."

Link it to a plain-language privacy statement that says who can see a submitted form, how long it is kept, and who to contact with a question. A statement a patient can read in a minute does more than one that mirrors the statute.

## FAQ

### Can I email appointment details?

The IPC's 2016 email fact sheet says custodians must notify patients of a written email policy and get their consent before using unencrypted email, and gives limiting it to appointment scheduling as an example. Keep reason-for-visit and clinical details out of ordinary email, and use encrypted messaging in your booking system where it exists.

### Is Google Forms acceptable?

For a newsletter sign-up with no health content, the risk is low. For anything close to intake, a general-purpose form tool becomes a service provider handling personal health information for you, with duties under O. Reg. 329/04 s. 6 that its standard terms may not address. Keep the website form generic and let your booking or EMR system collect the rest.

### Does my host need to be in Canada?

No. The IPC's PHIPA FAQ says the Act "does not require that personal health information be retained and stored in Ontario or Canada", while the custodian stays accountable for safeguards, for example through contracts. Disclosure to a person outside Ontario is limited separately by section 50. Check where your booking and EMR vendors store records and what their contracts say.

### Is a contact form that only asks for name and email outside PHIPA?

Not necessarily. PHIPA's definition includes information that identifies someone as a person's health care provider, so an existing patient's message to their clinic can be personal health information. Treat the form inbox with the same access controls as other patient communication, and ask your privacy officer or lawyer where your line sits.

## Next step

To have your forms checked against the safe-form rule, start with our [clinic websites page](/industries/clinics) or [request a free Redline](/redline): we mark up your homepage by hand, with what to cut, what to add, and why. Our [compliance overview](/services/compliance) explains how we flag the rules that apply to your sector, and our [Ontario Practice Website Index](/research/ontario-practice-website-index) records how many Ontario practice sites ask for health or case details in a first-contact form. For the cost side, see [what a website costs in Ontario](/blog/website-cost-ontario).

*Reviewed for accuracy against the cited primary sources on 15 October 2026. General information, not legal advice.*

## Sources

- [Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A (ss. 3, 4, 12, 17, 18, 20, 29, 30, 50; consolidated 1 January 2026)](https://www.ontario.ca/laws/statute/04p03) (accessed 2026-10-15)
- [O. Reg. 329/04 under PHIPA, s. 6 (persons who supply electronic services to custodians)](https://www.ontario.ca/laws/regulation/040329) (accessed 2026-10-15)
- [Frequently Asked Questions: Personal Health Information Protection Act (September 2015)](https://www.ipc.on.ca/sites/default/files/legacy/2015/11/phipa-faq.pdf) (accessed 2026-10-15)
- [Fact Sheet: Communicating Personal Health Information by Email (September 2016)](https://www.ipc.on.ca/sites/default/files/legacy/2016/09/Health-Fact-Sheet-Communicating-PHI-by-Email-FINAL.pdf) (accessed 2026-10-15)