Recording calls in Ontario health care: what PHIPA expects

Recording calls is common in health care. Care homes record their main lines to resolve family concerns, clinics record to train front desk staff, and pharmacies record to settle disputes about what was said. The question we hear most is whether you're allowed to, and what you need to do to stay on the right side of Ontario's health privacy law.

The short answer: yes, you can record, but a recording that captures someone's health information comes with real obligations. This guide walks through them in plain language.

One party consent isn't the whole story

Many business owners have heard that Canada is a "one party consent" country, and that's true. Under section 184 of the Criminal Code, it isn't a crime to record a call you're part of, even if the other person doesn't know.

But the Criminal Code only answers whether recording is a crime. It doesn't answer whether it's allowed under privacy law, and that's a separate question. When an organization records a call, it's collecting personal information about the person on the other end. Privacy law governs that collection.

For most businesses, that law is PIPEDA, and the Office of the Privacy Commissioner of Canada's guidance on recording customer calls is clear: tell the caller the call is being recorded, explain why, and get their consent. Consent can be implied if the caller hears the notice and carries on with the call.

So recording without telling anyone won't get you charged, but it can still put you offside privacy law.

Which privacy law applies to you

In Ontario health care, the law that usually applies is the Personal Health Information Protection Act (PHIPA), not PIPEDA. PHIPA has been recognized as substantially similar to PIPEDA, so health information custodians follow PHIPA for personal health information they handle within Ontario.

Health information custodians include, among others:

• health care practitioners such as physicians, nurses, physiotherapists, dental professionals and dietitians
• long-term care homes and retirement homes
• hospitals and psychiatric facilities
• pharmacies and laboratories
• ambulance services

Personal health information under PHIPA can be oral or recorded. So when a resident's daughter calls about her mother's medication, or a patient calls to reschedule a follow-up, the recording of that call is personal health information. That's the starting point for everything below.

If you're not a custodian, for example a medical supply company or an insurance broker, PIPEDA and the federal guidance above are your reference instead.

Consent and the recording greeting

PHIPA generally requires consent to collect, use or disclose personal health information, and that consent can be express or implied. Either way, it has to be knowledgeable: it should be reasonable to believe the person knows why you're collecting their information and that they can say no.

For phone calls, the practical way to make consent knowledgeable is a short notice at the start of the call. For inbound calls, put it in your greeting:

Thanks for calling Maple Grove Care. Calls may be recorded to help us maintain the quality of our care and services.

For outbound calls, the greeting doesn't play, so staff should say it themselves at the start: "Just so you know, this call is recorded." The federal Privacy Commissioner has specifically criticized relying on a privacy policy alone for calls the organization places, so a quick verbal mention is worth building into habit.

A few more things to get right:

• Say why. "Quality of care" or "training and quality" is better than "may be recorded" with no reason.
• Have an answer for people who object. Know what staff should do if a caller doesn't want to be recorded, whether that's pausing the recording or offering another way to reach you.
• Put it in your written statement. PHIPA requires custodians to have a written public statement describing their information practices. If you record calls, that statement should say so.

How long to keep recordings

PHIPA doesn't set a specific retention period. It requires custodians to keep, transfer and dispose of records securely, and to keep records long enough for a person to exhaust any recourse they have on an access request. Your own sector rules may add to that.

In practice, the best approach is a short, defined period that matches why you're recording. If recordings are for quality and dispute resolution, a few weeks often covers it. Whatever you choose:

• Write it down in your privacy policy and your written statement.
• Make the system enforce it. Deletion should happen automatically, not depend on someone remembering.
• Save a copy when it matters. If someone asks for a copy of a call, complains about it, or a dispute is likely, save that recording before the retention period runs out. A person has a right to request access to their own personal health information, and custodians generally have 30 days to respond.
• Don't rely on the recording as the record. If a call contains something you're required to document, put it in the proper record. For example, long-term care homes must document verbal complaints that aren't resolved within 24 hours under O. Reg. 246/22, s. 108. A recording that expires in a few weeks isn't a substitute for that written record.

Who can listen

Under PHIPA, viewing or accessing personal health information counts as a use, and listening to a recording is no different. Several of the Ontario Information and Privacy Commissioner's most serious cases have involved staff accessing records they had no reason to see.

Treat call recordings the way you'd treat a chart:

• Give access only to the people who need it for their role, such as a manager reviewing complaints.
• Use individual logins rather than a shared account, so you know who listened to what.
• Remove access promptly when staff leave or change roles.

If your phone system produces call transcripts or summaries, those contain the same information as the recording and deserve the same care.

Your phone provider's role

If a phone company stores your recordings, PHIPA treats it as an electronic service provider. Under O. Reg. 329/04, a provider that isn't acting as your agent can't use the personal health information it has access to except as necessary to provide the service, can't disclose it, and must make sure its staff agree to the same restrictions.

You remain accountable, though. That's why it's worth asking your provider a few direct questions:

1. Where are recordings stored?
2. Which of your staff can access our recordings, and under what circumstances?
3. What is the default retention period, and can we change it?
4. Does deletion happen automatically, and is it permanent?
5. How and when would you tell us about a security incident affecting our recordings?

On storage location: PHIPA doesn't require personal health information to stay in Ontario or Canada. But if it leaves, you're still accountable for how it's protected, so many custodians prefer a provider that keeps everything in Canada. It removes a set of questions you'd otherwise have to answer.

If something goes wrong

If personal health information is stolen, lost, or accessed by someone who shouldn't have it, PHIPA requires the custodian to notify the affected people at the first reasonable opportunity. In certain circumstances, such as a significant breach, the custodian must also report it to the Information and Privacy Commissioner of Ontario. Custodians also file annual breach statistics with the Commissioner.

For call recordings, the most common risks are ordinary ones: a former employee whose login still works, a recording emailed to the wrong person, or a shared password. The access practices above prevent most of them.

A short checklist

1. Add a recording notice with a reason to your main greeting.
2. Train staff to mention recording at the start of outbound calls.
3. Decide what staff do when a caller objects.
4. Mention call recording in your written statement of information practices.
5. Set a retention period and confirm your system deletes automatically.
6. Limit who can listen, with individual logins.
7. Ask your phone provider the five questions above and keep their answers on file.

How Vantact handles call recordings

For our healthcare clients, here's how the questions above apply to Vantact:

• Retention: recordings are kept for 30 days by default, and the period can be adjusted per client on request.
• Access: recordings are available to the client's own authorized users. Vantact staff access a recording only when a client asks for help with a specific call.
• Storage: recordings are stored in Canada.
• Encryption in transit: call signalling is encrypted with TLS and call audio with SRTP.
• Call analytics: if you use our AI call analytics, transcripts and summaries are processed on Vantact hardware in Toronto, and nothing leaves Canada.

More detail on our security practices is on our Security and trust page.

This guide is general information about Ontario and federal privacy rules, not legal advice. Your obligations depend on your organization and the calls you record, so check with your privacy officer or legal counsel before changing your practices. For the source material, see the Information and Privacy Commissioner of Ontario's PHIPA FAQ and the federal Privacy Commissioner's call recording guidance.