MVP program · Clinical care providers
Minimum Viable Privacy Program for Mental Health & Counselling Practices
Minimum Viable Privacy packages the custodian foundations a solo Registered Psychotherapist or psychologist needs before opening a practice, for $5,499 CAD a year. It exists for the clinician setting up alone, choosing a practice-management platform, writing consent forms, and realizing that PHIPA's custodian obligations landed on them personally the moment they took their first referral, with no team and no budget for a sprawling consulting engagement.
Reviewed by the Privacy Horizon team · Last reviewed
What you're protecting
What the MVP program builds for a solo practice
A single practitioner does not need an enterprise privacy program; they need the specific, load-bearing pieces done correctly from day one.
The consent forms clients sign first
Intake consent covering how records are collected, stored electronically, and used, written to satisfy PHIPA and CRPO's Electronic Practice standard rather than adapted from an unrelated template.
A workable retention schedule
A short, workable timeline for one practitioner's caseload: how long process notes and test protocols stay on file before secure destruction, sized to a single-clinician practice rather than a multi-site program.
The platform choice itself
Guidance on evaluating a practice-management platform like Owl Practice or Jane against what a solo custodian actually needs to verify before trusting it with every client file.
A basic incident response plan
A short, usable plan for a lost device or a platform breach, so the first response to an incident is not improvised on the spot.
Regulatory map
What a solo practitioner is on the hook for from day one
Custodian status does not wait for a practice to grow; it applies the moment a solo clinician begins providing care.
Custodian duties from day one
PHIPA's section 3(1) para 1 places custodian status on the practising clinician the day care begins, whether that clinician works alone or leads a team of thirty.
The information-practices statement requirement
Section 12(2) requires a written statement of information practices available to clients, one of the first documents most solo practitioners have never actually drafted.
CRPO's baseline record-keeping standard
Standard 5.6 sets expectations for safeguards, backups and audit trails that apply regardless of practice size, so a one-person practice needs a real answer, not an assumption the platform handles it.
The March 1 statistics deadline
The March 1 statistics filing applies to every custodian, including a solo practitioner who has never had a reportable incident and still needs to file accordingly.
What goes wrong
What a new solo practice is most exposed to
The risks facing a first-year practitioner are less dramatic than a major breach and more likely to be a foundational gap discovered too late.
No documented consent to electronic delivery
A practitioner who moved straight to virtual sessions without formal consent language cannot show a client agreed to it specifically if ever asked.
A platform chosen without real vetting
Selecting a practice-management tool based on price or convenience alone, without confirming what security attestations it actually holds, leaves the foundation of the whole practice unverified.
No plan for a lost laptop or phone
A solo practitioner working from a personal device with no plan for loss or theft faces the same PHIPA notification duty as a large clinic, with no one else to help respond.
An access request with no process behind it
A first client access or correction request, arriving before any policy exists to guide the response, forces a solo practitioner to improvise under pressure.
Our mvp program for mental health & counselling practices
What Minimum Viable Privacy includes
The program is built to establish the essential controls quickly, without demanding a solo practitioner take on a project bigger than their practice.
Baseline privacy gap review
An assessment of where your current setup, or planned setup, aligns with PHIPA and CRPO expectations and where the gaps are.
Coaching hours
Twelve hours of direct coaching to walk through platform choice, consent language and the specific questions unique to opening a therapy practice.
Policy development
Core policies drafted for a solo practice: information-practices statement, retention schedule and electronic-consent language.
Readiness assessment workshops
Structured sessions working through your specific setup, so the foundational pieces fit how you actually plan to practise, not a generic checklist.
Training and human-risk assessment
Training and human-risk assessment coverage for up to ten seats, useful as soon as the practice brings on its first contractor or part-time assistant.
How the engagement runs
How MVP runs for a solo practitioner
Step 1
Baseline review
We assess your current or planned setup, including platform choice and any consent language already drafted, against PHIPA and CRPO's standards.
Step 2
Prioritize the essentials
Findings are turned into a short, ordered list of what needs to exist before you see your first client, and what can follow shortly after.
Step 3
Build the core documents
Consent forms, an information-practices statement and a retention schedule are drafted through the coaching hours, sized to a solo practice.
Step 4
Set a path to grow into
The program leaves a structure that scales if the practice adds an associate or expands, rather than a one-time document that stops being relevant.
What it costs
MVP pricing for a solo Registered Psychotherapist
Minimum Viable Privacy is $5,499 CAD per year on a twelve-month term, covering the gap review, policy development, readiness assessment workshops, twelve coaching hours, and training with human-risk assessment for ten seats. The package price covers the full scope; there are no per-document add-on surprises.
Practitioners who bring on an associate, expand into a second province, or join an EAP panel with its own security expectations typically graduate to the Virtual Privacy Officer retainer, and the MVP's documents carry forward into it directly. Book a demo to see whether the package fits your practice.
Mental Health & Counselling Practices: MVP program questions, answered
At minimum, a Registered Psychotherapist practising alone needs a written information-practices statement, consent language covering electronic and telepractice delivery, a retention and destruction schedule for process notes, a documented reason for trusting the chosen practice-management platform, and a short incident response plan. MVP packages exactly these pieces into one structured, priced engagement rather than leaving a new practitioner to assemble them individually.
The consent language and information-practices statement should be in place before your first session, since they govern what the client is agreeing to from day one. The retention schedule, platform vetting and incident plan can reasonably follow within the first weeks of practice, but waiting until an access request or an incident forces the question is the outcome MVP is built to avoid.
No, and this is a common starting point, not a special problem. MVP works the same way whether you are pre-launch or already six months into practice: the gap review simply reflects where things stand today, and the program builds the missing pieces from there rather than requiring a restart.
The core MVP program is built around PHIPA and CRPO's standards; a practitioner seeing clients in Quebec needs Law 25's additional layer folded in, including who at the practice is designated to handle privacy matters and how incidents get logged and tracked. Tell us about your Quebec caseload when we start and the program will be sized accordingly.
Most solo practitioners either renew MVP as their ongoing baseline or, if the practice has grown to include an associate or a heavier questionnaire and panel workload, move to the Virtual Privacy Officer retainer for ongoing monthly support. Either way, the documents and structure MVP built stay in use rather than starting over.
More for mental health & counselling practices
Other services for this niche
About this service
What's Protecting Your Business from the Next Threat?
Don't wait for a breach to expose your vulnerabilities. Let Privacy Horizon secure your data, ensure compliance, and build lasting trust.