In October 2025, the Information and Privacy Commissioner of Ontario (“IPC”) released Decision 309 arising from a patient complaint about a dental practice that had recorded her three virtual consultations. The patient argued that the recordings were made without her knowledge or consent, constituting a breach of the Personal Health Information Protection Act, 2004 (PHIPA).
The IPC ultimately dismissed the complaint, providing needed clarity dentists have been waiting on: dentists may legally record virtual consultations, provided they meet all requirements for consent, purpose, and privacy protections. The decision also highlights how important it is for practices to keep their systems, workflows, and privacy policies up to date.
Background
After requesting her dental records, the patient discovered three video recordings of past virtual appointments conducted during the early stages of the COVID-19 pandemic. She insisted she had never been told the sessions would be recorded, had never acknowledged anything on the platform indicating consent, and had not been informed about the purpose of recording. She viewed the recordings as a violation of privacy and a betrayal of trust.
The dentist provided a different account. Her evidence showed that, during the pandemic:
- the office selected a HIPAA-compliant platform that included automatic recording notices and on-screen indicators;
- patients were required to provide oral consent before virtual appointments were scheduled;
- platform pop-ups notified patients when recording began, and
- a visual indicator remained visible throughout the session.
The dentist acknowledged she did not have advanced conversations specifically about recording each consult but believed the steps above and the patient’s continued participation constituted implied consent.
The Issues
The central part of the IPC’s review was two core questions:
- Were the recordings made with appropriate PHIPA consent?
- Did the dental practice meet its obligations to protect personal health information when using a virtual-care platform?
The Decision
The IPC found no reasonable grounds to proceed to a formal review and dismissed the complaint.
The IPC’s reasoning relied on the dentist’s good-faith efforts in a rapidly evolving situation. Several factors weighed in the dentist’s favour.
Lack of formal guidelines
- Virtual care was new to dentistry at the time of the events, and no formal guidance from the RCDSO or IPC yet existed. While the adjudicator emphasized that express consent is now strongly preferred for recording virtual health-care visits, they acknowledged that the state of uncertainty at the time contextualized the dentist’s decisions.
Use of a secure, reputable virtual platform
- The dentist deliberately chose a HIPAA-compliant system that included clear consent prompts and recording indicators, and that allowed patients to exit sessions freely. While HIPAA compliance does not automatically mean PHIPA compliance, it showed that the dentist took privacy seriously and implemented reasonable safeguards.
Documentation of patient consent
- Even though the consent was not specific to recording, the practice consistently obtained oral consent to conduct virtual appointments and enter patient information into the platform. This supported the argument that the patient understood the nature of the technology and the sharing of her personal health information.
Purpose-related justification
- The dentist stated the recordings were made to ensure accurate clinical documentation and continuity of care. The IPC found no evidence of an improper or unlawful purpose.
Policy modifications
- After the issuance of formal guidance from the RCDSO, the dentist revised the practice’s virtual care policy, implemented mandatory express consent for recording, restricted recording to situations where it is clinically necessary and enhanced documentation procedures. The IPC saw these updates as meaningful evidence of responsible custodianship under PHIPA.
What This Means for Dentists Today
This case offers reassurance and a reminder: you can record virtual consultations, but only if you meet PHIPA’s strict requirements. Dentists should now assume that regulators expect a higher standard of clarity and transparency than existed during the pandemic period.
Key takeaways for dental practices include:
- Obtain express and documented consent before any recording, ideally in writing or through a documented oral agreement.
- Explain the purpose of recording clearly, including how the recording will be used, stored, and retained.
- Use secure and reputable platforms with clear recording notifications.
- Limit recordings to situations where they are clinically necessary, not routine appointments.
- Update privacy and virtual care policies to reflect the RCDSO’s and IPC’s guidance.
Bottom Line
This case offers dental practices a straightforward message that appointment recordings are permissible, but the standards for consent and transparency are high. If your practice uses virtual-care tools or is considering recording consultations, now is a good time to review your workflows, consent processes, and privacy policies. Getting it right is not just good risk management—it is required by law.
