What confidentiality actually means in Ontario, what a dietitian can and cannot share, where the real limits are, and what happens to the notes about you.
This question tends to get asked quietly, usually near the end of a first phone call, and quite often it does not get asked at all because it feels awkward. It deserves a plain answer, so here is one. Reviewed by Lauren Hofstee, RD, on 2026-07-29. Every statement below about Ontario law and professional obligations was checked that day against the Government of Ontario's own pages and the College of Dietitians of Ontario's own published standards and resources, with dates noted where they matter. This is general information, not individualized medical or nutrition advice, and it is not a substitute for medical monitoring. It is also not legal advice. If any of it will shape a decision you are about to make, ask the practitioner in front of you directly. Someone who handles that question well is showing you something useful about what working with them would be like.
Yes. What you tell a Registered Dietitian in Ontario is confidential, and that is not a personal promise or a professional courtesy. It is a legal duty with a statute behind it, a regulator that enforces it, and a complaints process if it is broken. The College of Dietitians of Ontario states on its confidentiality and privacy page, checked on 2026-07-29, that one of the highest obligations required of a dietitian is to protect the confidentiality and privacy of a client's personal health information, and gives the reason out loud: without confidentiality, clients would not be forthcoming or trust their health care providers with the very private and personal information necessary for their care. That is the honest logic of it. Care only works if you can say the true version. The rest of this page is the detail, including the limits, because a promise of total secrecy would not be true and you deserve better than a comfortable half answer.
Two Ontario laws do most of the work here. The Personal Health Information Protection Act, 2004, usually shortened to PHIPA, sets the rules for how personal health information is collected, used, and disclosed, and a dietitian in private practice is generally what the law calls a health information custodian, meaning the responsibility for keeping your information private sits with them personally. The Health Care Consent Act, 1996 governs consent to treatment itself. The College's practice resource on consent, checked on 2026-07-29, states that in keeping with both of those laws, dietitians have a legal and professional responsibility to obtain informed consent from a client for nutrition treatment and for collecting, using, and disclosing the client's personal health or other confidential information, and notes that the same obligation is written into the College's Professional Misconduct Regulation. In practical terms, that last part matters. Breaching your confidentiality is not simply bad manners. It is professional misconduct, and it is something you can report.
This is the piece most people are actually asking about when they ask whether it is confidential. They mean, will you tell my doctor. Ontario law allows health care providers to share information with each other for the purpose of providing you with care, without collecting a fresh signature every single time, on the assumption that you would want your care team to be able to talk to each other. The College's privacy toolkit for dietitians, dated November 2020 and checked here on 2026-07-29, sets out the conditions for that assumed consent: the information was received from you, from your substitute decision maker, or from another custodian, it was received for the purpose of providing you with health care, it is being used or shared for the purpose of providing you with health care, anything disclosed goes only to another health information custodian, and you have not withheld or withdrawn your consent. The toolkit notes that this is commonly called sharing within the circle of care, and that the phrase itself does not actually appear in PHIPA. Two things follow. First, this is not a licence to talk about you generally. It is narrow, and it is tied to your care. Second, express consent, spoken or written, is required to share your information with someone who is not a health information custodian, or with another custodian for a purpose other than your health care. Your employer, your school, your insurer, and your family are all in that second category.
You are allowed to say no to a specific piece of sharing, and the law has a mechanism for it. The College's privacy toolkit describes it as the lock box. You can direct that part of your file is not shared with or given to another custodian. If the practitioner holding it believes the other provider genuinely needs that piece of information, they must tell the receiving provider that some relevant information has been withheld at your direction, but not what it is. That is worth reading twice, because it means you are not choosing between complete openness and saying nothing. The same toolkit is clear about one boundary. A direction not to record pertinent information in the first place is not valid. Your dietitian has to keep an honest record of the care they provide. What you can shape is where that information travels. In real life this comes up more than you might think. Someone wants their dietitian to know about a purging behaviour but is not ready for their family doctor to know this week. Someone is fine with the whole team knowing about the eating and not fine with a note about a past assault travelling anywhere. You can say that. It is a normal request, and a good practitioner will talk you through what it means rather than treat it as a problem.
Notes exist. They are usually far less dramatic than people imagine, and they are not a transcript. A dietetic record is generally the clinical picture: what brought you in, what is relevant to your nutrition care and your medical safety, what the plan is, what changed, what was discussed and consented to. It is written to serve your care, and to let another provider pick it up safely if they ever have to, not to be read as a story about you. On the question people ask second, which is how long it hangs around, the College's Professional Practice Standards for Record Keeping, dated 2019 and checked on 2026-07-29, requires a system for the secure retention of client health records for at least ten years after the date of the client's last visit, or, if the client was younger than eighteen at the last visit, at least ten years after the date the client turns or would have turned eighteen. The same standard applies to financial records for individual counselling services. It also requires that entries be permanent, that systems be in place so content is not lost or deleted, that corrections preserve the original content rather than erase it, and that collection, use, storage, disclosure, transmission and disposal all protect your privacy through measures such as passwords and encryption where applicable. If you would like to know what is in your file, you are allowed to ask, and there is more on that below.
Every health professional in Ontario has a small number of situations where confidentiality gives way, and you should hear them from me rather than discover them later. The clearest one is child protection. The Government of Ontario's page on reporting child abuse and neglect, updated April 20, 2026 and checked here on 2026-07-29, states that everyone in Ontario, including professionals who work closely with children, must immediately report to a children's aid society if they have reasonable grounds to suspect a child is or may be in need of protection, and states directly that this duty overrides professional confidentiality and specifically overrides PHIPA, with the only exception being lawyer and client privilege. The second is risk of serious harm. The College's privacy toolkit lists disclosure to address a significant risk of serious bodily harm to a person or group among the situations where information may be shared without consent. The others are narrower and mostly procedural: cooperating with a College investigation or a legally authorized inspection, legal proceedings where the practitioner is a party or a witness, and anything else permitted or required by law. That is the whole list in practice. Note what is not on it. Being unwell is not on it. Restricting, bingeing, purging, using laxatives, exercising compulsively, none of that triggers a report. Telling me you have been struggling for eleven years and have never said it out loud does not set anything in motion behind your back. If I ever thought something needed to involve someone else, I would tell you, and we would talk about how, unless the law genuinely did not leave room for that conversation.
This is the version of the confidentiality question that people most often ask last, and it is a fair one, particularly if your benefits come through your workplace. The starting point is the rule above: express consent is required to share your personal health information with anyone who is not a health information custodian, and an insurance company is not one. Your dietitian does not send your notes to your insurer. What an insurer sees is what a claim requires, which typically means the practitioner's name and registration, the date, the type of service, and the amount. Some plans ask for more before they will reimburse, such as a doctor's note or a stated reason for care, and if yours does, that request comes to you and you decide. If it matters to you that your employer learns nothing, ask your insurer directly what they report back to a plan sponsor, since group plans generally report claims in aggregate rather than by name, and the person who can confirm that for your specific plan is the insurer, not your dietitian. It is also completely reasonable to pay privately and skip the claim entirely if that buys you peace of mind. There is a plain breakdown of fees, benefits, and the tax side on the cost and coverage page for Ontario.
Ontario handles this differently than most people expect, and the difference matters enormously in eating disorder care. The College's practice article on consent to treatment based on capacity, not age, checked on 2026-07-29, states that the law does not set a minimum age to consent to treatment, that dietitians should involve children based on their capacity to consent rather than their age, and offers general guidance that children under seven are incapable of consent for almost any treatment, children between seven and twelve can rarely consent, and youth over twelve need to be assessed carefully case by case. It also states that clients, including children, have the right to know how, why, and to whom their personal health information will be collected, used, and disclosed, and that all capable clients have the right to give and withdraw consent for that. On the information side, the College's privacy toolkit notes that a custodial parent can authorize decisions about the personal health information of a child fifteen or younger unless the child disagrees, unless the child consented to the original treatment on their own, or in certain family counselling situations. In everyday terms, a capable teenager has real say over both their care and their information. For parents, that can feel like being shut out at the worst possible moment. It is usually the opposite. Young people tell the truth to someone they believe will not immediately relay it, and the truth is what makes the care work. Most families land on an arrangement where the parent is told what they need in order to support meals and safety without the whole session being reported back. If you are the one supporting someone, there is a broader map of the options on the Ontario eating disorder support page.
When care happens by video, the professional half of privacy stays the same, and a second half enters the picture that belongs to you. On my side, that means a secure platform, a private space, and no recording of a session without your explicit consent, ever. On your side, it means the practical question of who else is in the house. It is worth thinking about before the first appointment rather than in the first thirty seconds of it. Headphones help more than anything else. A car in a driveway is a legitimate therapy room and a lot of people use one. A walk with earbuds works when sitting still feels like too much. If someone is home and you would rather they did not hear, say so at the start and we can work around it, including keeping my side of the conversation vague enough that only your half is revealing. If it is not going to be private at home in any reliable way, that is genuinely worth naming, because it changes what a session should look like. There is more on how virtual work is set up on the virtual nutrition counselling in Ontario page.
Confidentiality is not only about keeping things from other people. It also gives you rights over your own information, and very few people know they have them. Under PHIPA, as summarized in the College's privacy toolkit checked on 2026-07-29, you have a broad right of access to the personal health information a custodian holds about you. A request must be answered as soon as possible and no later than thirty days after it is received, with one possible extension of another thirty days where necessary. The custodian must help you make a meaningful request if you need help, should explain terms, codes, and abbreviations where reasonably practical, and must provide information kept electronically in an electronic format so you can actually take it with you. Only a reasonable cost recovery fee may be charged, with an estimate given in advance, and the toolkit notes that the Information and Privacy Commissioner has held that thirty dollars for processing a request and copying the first twenty pages, plus twenty five cents per additional page, is reasonable. There is a matching right to ask for corrections to errors in your record, and where a correction is refused, you must be told of your right to add a concise statement of disagreement to the record and of your right to complain to the Information and Privacy Commissioner of Ontario. Access can be refused in a few defined situations, including where there is a risk of serious harm to your treatment or recovery or of serious bodily harm to someone else, and if a request is refused you must be told you can complain to the Commissioner, with the burden of justifying that refusal sitting with the custodian rather than with you.
Most of what I have described is procedure. The reason it matters is not procedural at all. People carry eating things privately for years, sometimes decades, and by the time they book a first call the secrecy has become part of the problem rather than a side effect of it. There is a specific fear underneath the confidentiality question, and it is rarely about the law. It is closer to this: if I say the true version, someone will do something about it that I did not agree to, or someone in my life will find out and look at me differently. So it is worth stating the ordinary reality. What happens when you tell a dietitian the true version is that we start working with the actual situation instead of a polite outline of it. Nobody is contacted. Nothing is announced. The information stays where it is unless you decide otherwise or one of the narrow legal limits above genuinely applies, and those limits are about immediate safety, not about being unwell. You are also allowed to test the water. Nothing says you have to arrive with everything. Plenty of people say the smallest true thing first and see how it lands. If you would like to ask any of this before booking anything, the introductory call with me is free, runs about fifteen or twenty minutes, and carries no obligation to continue. You can ask exactly what would be shared, with whom, and what would end up in a note, and get a straight answer. If a conversation feels like a lot right now, reading about how I work or the guide to finding an eating disorder dietitian in Ontario is a perfectly good first step instead. There is no pressure here either way.
Not automatically, and not everything. Ontario law allows providers to share information with each other for the purpose of providing you with care, which is commonly called the circle of care, and the College's privacy toolkit sets out the conditions for that, including that you have not withheld or withdrawn your consent. In practice, sharing with your doctor is usually about the clinical picture rather than the content of a conversation, it is normally discussed with you, and you can direct that a specific part of your file not be shared. Sharing with anyone who is not a health care custodian, such as an employer, a school, or a family member, requires your express consent.
You can direct where information travels, but not whether care is recorded. The College's privacy toolkit, checked on 2026-07-29, states that a direction not to record pertinent information is not valid, while a client may direct that part of their file is not shared with or given to another custodian, which is commonly called the lock box. If the practitioner believes the other provider needs that information, they must say that something relevant has been withheld at your direction, without revealing what it is.
In a small number of defined situations. The Government of Ontario's page on reporting child abuse and neglect, updated April 20, 2026, states that anyone with reasonable grounds to suspect a child is or may be in need of protection must report immediately to a children's aid society, and that this duty overrides professional confidentiality and PHIPA, with the only exception being lawyer and client privilege. The College's privacy toolkit also lists disclosure to address a significant risk of serious bodily harm, cooperation with a legally authorized investigation including a College investigation, legal proceedings where the practitioner is a party or witness, and anything otherwise permitted or required by law. Struggling with eating is not on that list.
Your dietitian does not send your notes to an insurer, because express consent is required to share personal health information with anyone who is not a health information custodian. A claim generally carries the practitioner, the date, the service, and the amount. Some plans ask you for more before reimbursing, and that request goes to you. If you want certainty about what a plan sponsor sees, ask your insurer directly, since that varies by plan. Paying privately and not claiming is always an option if it buys you peace of mind.
Yes. PHIPA gives a broad right of access to your own personal health information, and the College's privacy toolkit notes that a request must be answered as soon as possible and no later than thirty days, with one possible thirty day extension, that electronic records must be provided in an electronic format, and that only a reasonable cost recovery fee may be charged with an estimate given in advance. You can also ask for corrections to errors, add a statement of disagreement if a correction is refused, and complain to the Information and Privacy Commissioner of Ontario about a refusal to give access or to correct.
The College of Dietitians of Ontario's Professional Practice Standards for Record Keeping, dated 2019 and checked on 2026-07-29, requires a system for the secure retention of client health records for at least ten years after the date of the client's last visit, or, where the client was under eighteen at the last visit, at least ten years after the date the client turns or would have turned eighteen. The same period applies to financial records for individual counselling services, and the standard also requires that entries be permanent and that corrections preserve the original content.
The first call is free, and there is no pressure to continue. It is just a calm conversation about what you are looking for.
Book a free intro call