Policy development · Clinical care providers
Privacy & Security Policy Development for Physiotherapy & Chiropractic Clinics
A privacy policy for a physiotherapy or chiropractic clinic has to say, in plain language, what happens to a chart once it leaves the clinic for an auto insurer, WSIB or a patient's lawyer, since that is the disclosure patients actually ask about. We draft policies that name those third-party-payer flows directly instead of relying on vague 'as required by law' wording, and that set a retention schedule matching whichever College standard applies to the treating practitioner. Clinics usually commission this when a patient-facing policy is overdue, when direct billing is added, or after a patient asks a pointed question about where their file went.
Reviewed by the Privacy Horizon team · Last reviewed
What you're protecting
What the policy has to say clearly
A generic clinic privacy policy misses the disclosures that actually matter here.
Disclosure to auto insurers and WSIB
The policy states plainly that treatment plans, invoices and reports are routinely sent to auto insurers through HCAI and to WSIB for program-of-care claims, so patients aren't surprised later.
Disclosure to lawyers and adjusters
Where personal-injury or workplace claims are involved, the policy explains when and why records go to a patient's lawyer or an insurer's adjuster, and what consent that requires.
Direct-billing consent language
Submitting a claim directly to an extended-health insurer on the patient's behalf involves sharing specific information with that insurer, and the policy sets out what the patient is agreeing to when they choose direct billing.
Retention by profession
Where the clinic includes both physiotherapists and chiropractors, the policy states each professional's retention period separately rather than quoting a single number that's wrong for half the charts.
Lock-box and consent-directive rights
The policy tells patients they can ask that specific information be withheld from a specific recipient, and describes, in general terms, how that request is handled.
Regulatory map
What the policy has to align with
Several duties translate directly into specific policy language for this niche.
PHIPA's disclosure and consent framework
PHIPA sets out when a custodian may disclose personal health information without express consent and when it can't, which shapes exactly how the insurer-disclosure section of the policy is worded.
College of Physiotherapists' record-keeping expectations
The Record Keeping Standard's minimum ten-year retention, or to age 28 for a minor, has to be reflected accurately in the policy's retention section for physiotherapy charts.
Chiropractic retention under CCO S-002
Chiropractic files carry a distinct seven-year floor, extended to age 18 plus seven years for a minor, and that number needs its own line, separate from the physiotherapy retention clause in a mixed-practice policy.
HCAI's mandatory role in auto-claim billing
Because facilities treating motor-vehicle-accident patients must use HCAI for OCF forms, the policy names that system directly rather than describing insurer disclosure in the abstract.
What goes wrong
What a weak or generic policy exposes the clinic to
A policy that doesn't match how the clinic actually operates is itself a source of complaints.
A patient surprised by an insurer disclosure
Patients who don't expect their assessment notes to reach an adjuster or a lawyer are more likely to complain or escalate, even when the disclosure itself was lawful.
A records-format or fee dispute
PHIPA Decision 185 turned partly on how a physiotherapy clinic communicated its process for providing records, showing that policy clarity affects how a request plays out.
Retention language that doesn't match College rules
A policy quoting one retention period for a clinic that includes both professions creates a documented gap the moment a College or IPC review compares the policy to actual practice.
Direct-billing consent gaps
Adding a new extended-health direct-billing option without updating consent language leaves the clinic relying on assumed rather than documented patient agreement.
Our policy development for physiotherapy & chiropractic clinics
What the policy development engagement produces
The engagement produces a working set of documents specific to this clinic's practitioners, not a single generic template.
Patient-facing privacy policy
A clear policy covering collection, use and disclosure, written specifically around insurer, WSIB and legal-referral flows rather than generic health-clinic language.
Consent language for direct billing
Specific wording confirming what a patient agrees to when direct billing is selected, distinct from general treatment consent.
Retention and destruction schedule
A schedule that applies the correct College-based retention period to each practitioner type, with a defined destruction process once it expires.
Internal disclosure procedures
Staff-facing guidance on how HCAI submissions, WSIB reports and lawyer requests are actually processed, so the public policy and internal practice match.
Lock-box and access-request procedures
Documented steps for handling consent-directive requests and patient access requests consistently across the clinic.
How the engagement runs
How we build the policy with your clinic
Step 1
Map your actual disclosures
We confirm which insurers, WSIB programs, lawyers and referral sources routinely receive records, so the policy reflects real practice rather than a template.
Step 2
Draft policy and consent language
The patient-facing policy and direct-billing consent language are drafted together, so they read as one consistent explanation to patients.
Step 3
Set the retention schedule
Retention periods are confirmed against the correct College standard for each practitioner type in the clinic and built into a single destruction schedule.
Step 4
Review and roll out
The clinic reviews the draft, front-desk and treating staff are briefed on what changed, and the policy is published where patients will actually see it.
What it costs
What determines policy development cost for a clinic
Cost depends on how many practitioner types and retention rules apply, how many insurer and billing relationships need their own consent language, and whether internal disclosure procedures are drafted alongside the public-facing policy.
Policy development is also included as part of the Minimum Viable Privacy package for a new clinic building its first policy set. Share your practitioner mix and billing arrangements and we will scope a tailored quote.
Physiotherapy & Chiropractic Clinics: Policy development questions, answered
It should name the disclosure directly: that OCF treatment plans and invoices go through HCAI to auto insurers, and that reports may go to a patient's lawyer or an insurer's adjuster in the course of a claim, rather than hiding it behind general 'as permitted by law' wording. Patients respond better to a policy that tells them plainly what happens to their file than one they have to interpret after the fact.
You need consent language specific to what direct billing actually involves: submitting claim details directly to the patient's extended-health insurer on their behalf. That's distinct from general treatment consent, so the policy and any intake form should spell out what information the insurer receives when a patient chooses that option.
It has to reflect the extended retention period each College sets for minor patients: physiotherapy records must be kept until a minor turns 28 under the College of Physiotherapists' Record Keeping Standard, while chiropractic files run to age 18 plus seven years under CCO Standard S-002. A schedule that only states the adult retention period is incomplete for any clinic treating children or teenagers.
One policy can cover both, as long as the retention section states each profession's rule separately rather than picking one number for everyone. Most mixed-practice clinics prefer a single patient-facing document with a clearly labelled retention table rather than maintaining two nearly identical policies.
Review it whenever the clinic adds a new billing arrangement, insurer relationship or referral source, and at least once a year regardless, since College standards and provincial privacy law both change periodically. A policy that hasn't been touched since the clinic opened is a common finding in access-request disputes.
More for physiotherapy & chiropractic clinics
Other services for this niche
About this service
Answers & guides
What's Protecting Your Business from the Next Threat?
Don't wait for a breach to expose your vulnerabilities. Let Privacy Horizon secure your data, ensure compliance, and build lasting trust.