Electronic Communication for Massage Therapists

Why This Matters for Massage Therapists

Many MTs now use electronic health records (EHRs), online booking systems, email communication, and social media for marketing. Each of these creates a digital trail that is subject to privacy legislation. A casual text message to a client about their next appointment, a social media post mentioning a treatment success, or an unencrypted email containing health information can all create serious regulatory and legal problems. Ontario's Personal Health Information Protection Act (PHIPA) governs how personal health information (PHI) is collected, used, disclosed, and stored — including in electronic formats. Understanding PHIPA's requirements for electronic communication is not optional.

Key Principles

• PHIPA applies to all electronic communication containing PHI. Any digital message that includes a client's name, health condition, treatment details, or appointment information is governed by PHIPA.
• Encryption is the baseline. Email containing PHI must be encrypted. Standard Gmail, Outlook, or Yahoo email is not secure enough for health information without additional encryption.
• Consent for electronic communication must be explicit. Before emailing, texting, or messaging a client, obtain and document their consent for that specific communication method. Include the risks (e.g., "email is not fully secure").
• Social media is public. Never post identifiable client information, treatment photos, or testimonials without explicit, documented written consent. Even with consent, avoid posting clinical details.
• Texting is for logistics only. If you text clients, limit it to appointment reminders and scheduling. Never discuss clinical information via text.
• Electronic records require the same standards as paper records. EHR entries must be accurate, timely, complete, and backed up. Access must be restricted to authorized users.
• Retention rules apply to electronic records. In Ontario, health records must be retained for 10 years from the last entry (or 10 years after the client turns 18 for minors).

Clinical Application

Electronic health records: If your clinic uses an EHR system (Jane App, Cliniko, etc.), ensure it is PHIPA-compliant. This means: data stored in Canada (or with appropriate safeguards), access controlled by individual login, audit trails for who accessed what, and regular backups. Your documentation standards are the same as paper — the format changes, not the requirements. Email with clients: Before sending any email containing health information, have the client sign an electronic communication consent form that explains: (1) email is not fully secure, (2) what types of information you will and will not send by email, and (3) their right to withdraw consent. Use a professional email address (clinic domain preferred over personal accounts). Never use email for urgent clinical communication. Online booking and intake forms: If clients complete intake forms online, the platform must encrypt data in transit and at rest. Confirm that the platform stores data in compliance with PHIPA. You are responsible for the privacy of information collected through platforms you choose, even if you did not build the platform. Social media professional use: Social media can be a legitimate marketing tool, but it requires clear boundaries:

• Maintain a separate professional account from your personal account.
• Never accept clients as friends/followers on personal accounts.
• Do not respond to client health questions via social media comments or DMs.
• Client testimonials require written consent and should never include clinical details.
• Avoid posting anything that could identify a client, even indirectly ("Had a great session treating a runner's IT band today" — in a small community, this may be identifiable).

Canada's Anti-Spam Legislation (CASL): Commercial electronic messages (marketing emails, promotional texts) require consent. See cmto-professional-standards/casl-anti-spam-legislation for details.