--- title: "PHIPA Website Forms Pass for Clinics | UXPro" description: "A fixed-price review of every form, booking widget and data path on your clinic website against PHIPA's collection limits. Cited, not legal advice." type: service serviceType: "Website form and data-flow review for Ontario health practices" reviewed: 2026-10-17 canonical: https://uxpro.ca/services/compliance/phipa-forms publisher: "UXPro Design Studio" license: "Quote freely with a link to the canonical URL." --- # A PHIPA pass for the forms on your clinic’s website. Reviewed 17 October 2026. Canonical page: https://uxpro.ca/services/compliance/phipa-forms Booking widgets, contact forms and intake pages are where a clinic website collects health information, often more than it needs. We map every form and where its answers go, and mark what to remove before anyone types it. **$650 CAD per site, plus HST.** For Ontario clinics and practices that take bookings, enquiries or intake through their website. Not legal advice. Every flag cites the rule we read, and your counsel decides what it requires of you. ## What we check Each line names the rule we read at its source. Where we give no rule, the check is our own practice rather than a legal requirement. - **What each form asks for, against what it needs**: Every field on every form, including “reason for visit” and free-text boxes, checked against the collection limits. (PHIPA s. 30(1) and 30(2)) - **Whether the answers are health information**: Which fields could identify a patient and relate to their health, care, payments or health number. (PHIPA s. 4(1)) - **Where the answers go**: Email inboxes, spreadsheets, booking platforms and form services: who holds the data, and which of them act on the clinic’s behalf. (PHIPA s. 12(1) and 17(1)) - **Trackers on booking and intake pages**: Analytics tags, pixels and chat widgets that load on the pages where health information is entered. - **The written public statement**: Whether the clinic’s statement of its information practices, contact person, access and complaints is reachable from the site. (PHIPA s. 16(1)) ## What you get - **A form inventory and data-flow map**: Every form, every field, and every system its answers pass through, on one page. - **Redlined forms**: Fields struck, replacements inserted, and a numbered note citing the section for each change. - **A short list for your privacy lead**: The questions only the clinic can answer: which processors have agreements, who the contact person is, how long submissions are kept. ## What we do not do - **Legal advice**: We are designers and developers. We flag lines that may engage a rule and cite it; what the rule requires of you is a question for your own counsel, and we will happily brief them. - **Decide whether you are a custodian**: Whether PHIPA applies to you, and how, depends on facts about your practice. That is for your counsel or the Information and Privacy Commissioner of Ontario’s guidance. - **A privacy impact assessment or a security audit**: We review the website’s forms and data paths, not your clinic systems, EMR or network. ## What it costs, and what it covers PHIPA forms pass: one fixed price per site, in Canadian dollars. HST is added to the figure. ### PHIPA forms pass Ontario clinics that collect anything about a patient through a website form or booking tool. **$650 CAD per site, plus HST.** What is included: - A form inventory and a map of where each answer goes - Redlined forms, with the PHIPA section cited beside each flag - A short list for your privacy lead Not included: - Legal advice - Deciding whether you are a custodian - A privacy impact assessment or a security audit Timeline: Agreed in the written quote ## Sources The official text, read by a person on our team on the date shown. If a rule has changed since, the source wins and we update this page. - [Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A](https://www.ontario.ca/laws/statute/04p03), Government of Ontario, e-Laws. Read: Sections 4 (definition), 12(1), 16(1), 17(1), 30(1) and 30(2); e-Laws currency date 30 September 2026. Read on 2026-10-02. ## Questions ### Does PHIPA apply to my clinic’s website? PHIPA applies to health information custodians and their agents. Whether that includes you is a legal question for your counsel. Our pass assumes it may, and shows what your forms collect and where it goes so that question can be answered quickly. ### Will you change our booking platform? No. We review what your site sends to it and how the booking page is set up. If a setting on the platform is the issue, we tell you which one. ### Is the intake form inside our booking platform covered? We read what the patient sees and types on your site and on the booking pages it links to, Jane and similar platforms included, and we note which fields that platform asks for. Changing the platform's own form is a setting on your account; we tell you which one. ## The other passes - [LSO marketing pass](https://uxpro.ca/services/compliance/lso-marketing): Ontario law firms whose website was written by a marketer, a template or several people over several years. - [AODA website pass](https://uxpro.ca/services/compliance/aoda): Ontario organisations with 50 or more employees in Ontario, which the website section of the regulation reaches, and smaller ones that want the same standard. --- Read the illustrated page: [PHIPA forms pass](https://uxpro.ca/services/compliance/phipa-forms)