Client Consent and Confidentiality Obligations under CMTO Rules
- Delta Law
- Jul 9
- 4 min read
Registered Massage Therapists in Ontario are entrusted with sensitive personal and health information. Every treatment involves both physical and personal interaction, and clients rely on their therapist’s professionalism to ensure privacy, safety, and informed decision-making.
The College of Massage Therapists of Ontario (CMTO) requires all RMTs to follow strict standards related to client consent and confidentiality. Understanding these obligations is essential for compliance, ethical practice, and maintaining trust with clients.
Understanding the CMTO’s Framework
The CMTO’s Standards of Practice outline how RMTs must obtain consent, maintain confidentiality, and safeguard client records. These requirements are grounded in both Ontario’s Personal Health Information Protection Act (PHIPA) and the Regulated Health Professions Act (RHPA).
In practice, this means every RMT must take proactive steps to ensure that clients understand and agree to all aspects of care, and that their personal health information is protected at every stage.
Informed Consent: What It Means
Consent is not a one-time signature on a form. It is an ongoing process of communication between the therapist and the client.
Under CMTO rules, informed consent must be:
Voluntary: The client must agree to treatment without pressure or influence.
Informed: The client must understand what the treatment involves, its benefits, potential risks, and possible alternatives.
Specific: Consent must apply to the particular treatment or assessment being provided.
Ongoing: Consent must be obtained before each new treatment or if the treatment plan changes.
Informed consent also includes explaining what areas of the body will be treated and confirming that the client understands and agrees before beginning.
RMTs should document consent in the client’s record after every session. Even if the client has signed an initial consent form, verbal consent should be reconfirmed before each appointment.
Implied vs. Express Consent
The CMTO distinguishes between express consent and implied consent.
Express consent occurs when the client clearly agrees to a treatment, either in writing or verbally. This is required before performing any massage therapy service that involves physical touch.
Implied consent applies in limited administrative contexts, such as sharing client information with another healthcare provider within a circle of care, when the purpose is directly related to treatment. Even in those cases, it is best practice to confirm the client’s understanding and permission before sharing any information.
Confidentiality and Privacy Obligations
Every RMT has a legal and ethical duty to protect the confidentiality of client information. This applies to all records, communications, and data—whether written, verbal, or electronic.
Under PHIPA, RMTs are considered “health information custodians.” They must take reasonable steps to safeguard client information against unauthorized access, disclosure, loss, or theft.
This includes:
Storing records securely in locked or password-protected systems.
Limiting access to authorized personnel only.
Using secure channels when sharing information electronically.
Having policies in place for the disposal or destruction of records once the retention period expires.
Confidentiality extends beyond treatment. RMTs should never discuss identifiable client information in public areas or with individuals who are not directly involved in the client’s care.
Recordkeeping Requirements
The CMTO requires RMTs to maintain client records for at least 10 years after the last treatment, or for 10 years after a client who was a minor turns 18.
Records must include:
Client contact information.
Health history and treatment plan.
Signed consent forms and notes confirming verbal consent.
Dates, times, and descriptions of treatments provided.
Any communications regarding referrals or information sharing.
Records must be accurate, legible, and updated after every session. They must also be accessible to clients upon request, as required under PHIPA.
Disclosure of Information
An RMT may only disclose client information in limited circumstances, such as:
When the client gives written consent.
When required by law, such as mandatory reporting obligations.
When necessary to prevent serious harm to the client or others.
Even when disclosure is legally required, RMTs should release only the information that is strictly necessary for the purpose.
If an RMT receives a request from an insurance company, lawyer, or another healthcare provider, it is best practice to obtain the client’s written authorization before releasing any records.
Common Mistakes to Avoid
Relying solely on an initial consent form without ongoing confirmation.
Discussing client cases in public spaces or open clinic areas.
Leaving client files unsecured or using shared devices without proper safeguards.
Sharing information with family members or third parties without written consent.
Failing to document consent or the rationale for information sharing.
These errors not only violate CMTO and PHIPA standards but can also erode client trust and expose RMTs to professional discipline.
Building a Compliant Practice
Compliance with CMTO’s consent and confidentiality standards is not only a regulatory requirement but also an essential part of maintaining professionalism.
Establishing written privacy policies, updating consent forms, and regularly training staff or contractors on PHIPA obligations helps ensure that your practice meets the highest ethical standards.
A properly structured client service agreement can also clarify how information is collected, stored, and used. Working with a lawyer to review your forms and policies helps safeguard your practice and gives clients confidence in how their personal information is handled.
