A PHIPA pass for the forms on your clinic’s website.
Booking widgets, contact forms and intake pages are where a clinic website collects health information, often more than it needs. We map every form and where its answers go, and mark what to remove before anyone types it.
$650 CAD per site, plus HST. For Ontario clinics and practices that take bookings, enquiries or intake through their website.
Last reviewed
One flag from a PHIPA pass
The redline
An invented clinic booking form, phone width
Note 1. Booking form, step 1
Struck: Describe your symptoms, diagnosis and current medications (required)Inserted: Remove the field. Ask at the visit, where the record is kept.
A booking needs a name, a way to reach you and a time. A required box for symptoms, diagnosis and medications collects personal health information the booking does not need. The Act limits collection to what is reasonably necessary.
PHIPA, s. 30(1) and 30(2)
Or start with a Redline of your homepage
Not legal advice. Every flag cites the rule we read, and your counsel decides what it requires of you.
What we check
Each line names the rule we read at its source. Where we give no rule, the check is our own practice rather than a legal requirement.
What each form asks for, against what it needs
Every field on every form, including “reason for visit” and free-text boxes, checked against the collection limits.
PHIPA s. 30(1) and 30(2)Whether the answers are health information
Which fields could identify a patient and relate to their health, care, payments or health number.
PHIPA s. 4(1)Where the answers go
Email inboxes, spreadsheets, booking platforms and form services: who holds the data, and which of them act on the clinic’s behalf.
PHIPA s. 12(1) and 17(1)Trackers on booking and intake pages
Analytics tags, pixels and chat widgets that load on the pages where health information is entered.
The written public statement
Whether the clinic’s statement of its information practices, contact person, access and complaints is reachable from the site.
PHIPA s. 16(1)
What you get
A form inventory and data-flow map
Every form, every field, and every system its answers pass through, on one page.
Redlined forms
Fields struck, replacements inserted, and a numbered note citing the section for each change.
A short list for your privacy lead
The questions only the clinic can answer: which processors have agreements, who the contact person is, how long submissions are kept.
What we do not do
Legal advice
We are designers and developers. We flag lines that may engage a rule and cite it; what the rule requires of you is a question for your own counsel, and we will happily brief them.
Decide whether you are a custodian
Whether PHIPA applies to you, and how, depends on facts about your practice. That is for your counsel or the Information and Privacy Commissioner of Ontario’s guidance.
A privacy impact assessment or a security audit
We review the website’s forms and data paths, not your clinic systems, EMR or network.
What it costs, and what it covers
| Package | Price | What is included | Not included | Timing | Next step |
|---|---|---|---|---|---|
| PHIPA forms passOntario clinics that collect anything about a patient through a website form or booking tool. | $650CAD per site, plus HST |
|
| TimelineAgreed in the written quote | Ask about this: the PHIPA forms pass package |
Sources
The official text, read by a person on our team on the date shown. If a rule has changed since, the source wins and we update this page.
- Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A
Government of Ontario, e-Laws. Read: Sections 4 (definition), 12(1), 16(1), 17(1), 30(1) and 30(2); e-Laws currency date 30 September 2026.
Questions
PHIPA applies to health information custodians and their agents. Whether that includes you is a legal question for your counsel. Our pass assumes it may, and shows what your forms collect and where it goes so that question can be answered quickly.
No. We review what your site sends to it and how the booking page is set up. If a setting on the platform is the issue, we tell you which one.
We read what the patient sees and types on your site and on the booking pages it links to, Jane and similar platforms included, and we note which fields that platform asks for. Changing the platform's own form is a setting on your account; we tell you which one.
The other passes
- LSO marketing pass
Ontario law firms whose website was written by a marketer, a template or several people over several years.
- AODA website pass
Ontario organisations with 50 or more employees in Ontario, which the website section of the regulation reaches, and smaller ones that want the same standard.