Texting patient details to your lab: what Canadian privacy law says

Texting a lab about a case is not banned in Canada. No privacy law names text messages, and none forbids them.

What the law does say is that the practice and the lab are each responsible for protecting the patient information they send and hold. That responsibility is the problem with a text.

A message on a personal phone is hard to protect, hard to keep with the patient record, and easy to send to the wrong person. Every regulator that has written about electronic messages says the same three things in its own words.

This guide covers which law applies, what regulators expect, where a texted detail ends up, and what to do when one goes astray.

Which privacy law applies to you

Which law binds you depends on your province and on what you are.

The Office of the Privacy Commissioner of Canada lists the provinces with their own laws. Alberta, British Columbia and Quebec have private-sector laws deemed substantially similar to PIPEDA. Ontario, New Brunswick, Nova Scotia, and Newfoundland and Labrador have substantially similar laws for health information.

British Columbia

A private practice or a private lab in BC falls under the province’s Personal Information Protection Act, known as PIPA.

Section 34 puts the duty in one sentence. An organization must protect personal information in its custody or under its control by “making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks.”

The lab is an organization under PIPA in its own right, so both sides carry the duty for the same patient’s information.

Ontario

Ontario’s Personal Health Information Protection Act, known as PHIPA, works differently. It applies to health information custodians and to their agents.

The Information and Privacy Commissioner of Ontario’s guide to PHIPA lists health care practitioners as custodians and names dental professionals among its examples. A dentist is a custodian for the patient information in the practice’s records.

An agent is “any person who is authorized by a custodian to perform services or activities in respect of personal health information on the custodian’s behalf.” A lab making a crown from a dentist’s Rx fits that description.

The dentist stays accountable. The lab, as agent, must follow PHIPA and tell the dentist if information “is stolen, lost or accessed by unauthorized persons.”

Everywhere else

In the other provinces and territories, PIPEDA applies to a private practice and a private lab, unless one of the provincial laws listed above takes its place.

The rest of this guide uses the federal law, BC and Ontario, since those regulators have published the most on electronic messages.

What regulators expect

The laws differ in structure. The expectations behind them line up, and a text message meets each one badly.

Share only what the other side needs

PIPEDA’s limiting collection principle asks organizations to collect “only the personal information your organization needs to fulfill a legitimate identified purpose.”

Ontario’s IPC applies the same idea to messages. Its fact sheet on email says a custodian “still has a duty to limit the amount and type of personal health information included in an email.”

The BC College of Oral Health Professionals says it to dentists and dental technicians alike. Its Standards for the Oral Health Team, in force since 1 April 2026, say under standard 1.6 that you “only disclose necessary and relevant patient information when required by law or with your patient’s consent.”

A lab needs the tooth, the shade, the material and the due date. It rarely needs a full name and never a photo of a face.

Use safeguards that match the sensitivity

The federal commissioner’s safeguards principle is to protect personal information “in a way that is appropriate to how sensitive it is.” It names health information as generally sensitive, and lists passwords and encryption among the technical tools it expects.

Ontario’s IPC goes further for custodians. It expects messages between custodians to be “secured from unauthorized access by use of encryption, barring exceptional circumstances.” It also lists “communicating by email from professional, rather than personal accounts” as a basic safeguard.

A personal phone number is a personal account.

Keep a record you can produce

Standard 2.4 of the BC standards requires “complete and accurate records,” including “communications including informed consent discussions, and interactions.” Standard 1.9 requires “timely and secure access and transfer of records.”

Ontario’s IPC says the duty to retain and dispose of health information securely “applies to information contained in email communications.”

A shade change agreed by text on a Thursday night is part of the patient’s record. If it only exists on one phone, the record is incomplete the moment that phone is replaced.

Where a texted case detail actually ends up

A text feels like a private word between two people. On the phone it is a file, copied to places neither of them chose.

Ontario’s IPC lists the risks for email, and each applies to a text. A message can be “sent to the wrong recipient” by autocomplete. It is read on portable devices “which are vulnerable to theft and loss.” It can be “forwarded or changed without the knowledge or permission of the original sender.”

Dr. Joel Gaudet, the dentist who founded Tusko, describes the practice end of it:

“Sometimes a lab calls or texts me on a Saturday and I don’t see it until I’m home. Then I can’t reply until I’m back in the office, because I don’t have my cases in front of me.”

Dr. Joel Gaudet, Wave Dentistry

The message about a patient is now on a personal phone at home, and the case it belongs to is in the office.

A text thread and a message on the case

Two columns side by side. A text thread: lives on each person’s phone and its cloud backup; anyone holding either phone can read it; it is not in the patient record; when a phone is lost, the thread goes with it. A message on the case: lives on the case, with the Rx and the scans; the people assigned to the case can read it; it is part of the case record; when a phone is lost, the case is still in the office.

A text thread

Two personal phones

• No: Lives on each phone and in its cloud backup
• No: Readable by anyone holding either phone
• No: Sits outside the patient record
• No: Lost phone, lost thread

A message on the case

One shared case

• Yes: Lives on the case, with the Rx and the scans
• Yes: Readable by the people assigned to the case
• Yes: Part of the case record
• Yes: Lost phone, case still in the office

• The other person’s phone. Their lock screen, their notification preview, and whoever is beside them when it lights up.
• Two cloud backups. Most phones back up messages to a cloud account by default, and the account belongs to the person, not to the practice or the lab.
• Screenshots. A shade note screenshotted for a colleague sits in a photo library with the weekend’s pictures.
• Group chats. A floor that runs on one group thread shows every case detail to every member, including the person who left last month.
• The wrong contact. Two dentists with the same first name, one tap, and a crown detail is in a stranger’s inbox.

None of this is anyone’s fault. It is how phones work.

Safer habits that cost nothing today

You do not have to change software to cut most of the risk.

• Use initials or a case number. The lab can match a case by number, by initials and tooth, or by the scan file name. Keep the full name on the Rx and in the chart.
• No photos that show a face. A shade photo needs teeth and a shade tab. Crop before sending, or do not send.
• Keep the conversation with the case. Whatever was agreed by text, write it on the case or in the chart the same day, so the record stays complete.
• Use a work number, not a personal one. Ontario’s IPC lists professional accounts over personal ones as a basic safeguard, and the same reasoning applies to a phone number.
• Lock screen, hidden previews and remote wipe on any phone that receives case details. The IPC does not treat the loss of an encrypted device as a breach, and asks custodians to require staff to report any lost device.
• Write the policy down, and agree it with the other side. The IPC expects a written policy on when and how health information may be sent by email, and training on it. One page that both teams have read is enough to start.

They lower the harm if a message goes astray, but a text copied into the chart is still a text on two phones.

If it goes wrong: the first hour, and when to report

A text to the wrong number is a privacy breach. The OIPC for BC’s guide for the private sector uses almost that example: a breach happens “when personal information is mistakenly emailed to the wrong person.”

The first hour

The OIPC sets out four steps. The first three happen “as soon as possible following the breach,” and the fourth is prevention.

1. Contain it. Ask the wrong recipient to delete the message and confirm. If a phone was lost, wipe it.
2. Evaluate the risks. What was in the message, who has it, and what harm could follow. The OIPC lists “hurt, humiliation or damage to reputation” when “medical or disciplinary records” are involved.
3. Notify. Decide whether the patient needs to know, and whether a regulator does.
4. Prevent. Change the habit that let it happen.

Write down what happened, when, and what you did, as you go. The OIPC asks you not to “destroy evidence.”

When a breach has to be reported

This is where the provinces differ most, so check the rule that applies to you.

Ontario. The IPC’s guide says PHIPA “requires custodians to notify individuals at the first reasonable opportunity if personal health information is stolen, lost or accessed by an unauthorized person.” A lab acting as an agent “must notify the custodian of the breach at the first reasonable opportunity.” The dentist then tells the patient.

Under PIPEDA. The federal commissioner’s guidance says a breach must be reported to the commissioner, and the individuals notified, when it is reasonable to believe it “creates a real risk of significant harm.” Notification goes out “as soon as feasible.” The two factors are the sensitivity of the information and the probability it is misused. Records of every breach, reported or not, are kept for two years.

British Columbia. PIPA contains no duty to notify anyone of a breach. The OIPC for BC’s reporting page says reporting to the office is a best practice it strongly recommends, and that the commissioner continues to call on government to amend PIPA to require it.

The BC college adds its own expectation on top of the law. Standard 1.6.6 says you “take appropriate steps/action should a privacy breach occur,” and the standards are mandatory for every regulated oral health professional in the province.

Whatever the law requires, a lab that tells its practice the same day it finds a problem is the partner the practice keeps. Why dental lab cases go missing covers the operational side of the same scattered communication.

What to look for in a tool that replaces the text thread

The habits above lower the risk. They do not put the message where it belongs, which is with the case.

Texting persists because it is the fastest way to reach the other side, as the cost of phone tag explains. A replacement has to be as fast on a phone, or the thread comes back.

Ask these questions of any tool, including ours.

• Every message sits on the case. The question about a margin lives with the Rx, the digital impression and the due date, so the record is one record.
• Every user is named. Each person signs in as themselves, so a message comes from a person at the lab or the practice, never from a number.
• It works on a phone without a personal number. The lab owner on a Saturday can reply without handing out a cell number.
• The vendor can say where it is stored and who can open it. Canadian data residency for dental practices covers storage, and PIPEDA and dental software has the full list of vendor questions.
• You can get the record out. A case tracking record you cannot export is a record you cannot produce when asked.

In Tusko, messages and files sit on the case with the patient and the Rx, for both the practice and the lab. Our security page sets out how patient information on a case is handled, and you can see the shared case for labs and for practices.

This is general information, not legal advice.