PHIPA & HIPAA Privacy Notice – Sam’s Virtual Studio
Effective Date: September 12, 2026
At Sam’s Virtual Studio, we provide virtual administrative, operational, and practice support services to healthcare and wellness professionals. In the course of providing these services, we may be entrusted with information that is subject to privacy and health-information protection requirements.
We take the confidentiality and security of this information seriously and are committed to handling information in accordance with applicable privacy laws, contractual obligations, and the instructions of our clients.
This notice explains our approach to handling personal health information in connection with our services.
1. Canadian Privacy & PHIPA
For clients and practices operating in Ontario, personal health information may be subject to Ontario's Personal Health Information Protection Act, 2004 (PHIPA) and other applicable privacy requirements.
Where Sam’s Virtual Studio handles personal health information on behalf of a healthcare provider or organization, we will:
Treat personal health information as confidential.
Access and use information only as reasonably necessary to perform the services we have been engaged to provide.
Follow the privacy and security requirements applicable to our role and relationship with the healthcare provider or organization.
Follow the client's reasonable instructions regarding the collection, use, disclosure, retention, and handling of personal health information.
Limit access to personal health information to individuals who require access to perform authorized services.
Take reasonable administrative, technical, and physical safeguards to protect information against unauthorized access, use, disclosure, loss, or destruction.
Notify the appropriate client or organization of a suspected privacy or security incident in accordance with our contractual obligations and applicable requirements.
Return, delete, or otherwise securely dispose of information when it is no longer required, where appropriate and as agreed with the client.
Sam’s Virtual Studio does not independently determine the purposes for which a healthcare provider collects or uses patient information when we are acting on that provider's behalf. Our handling of such information is generally based on the services we have been contracted to provide and the instructions of the applicable client or organization.
2. U.S. Privacy & HIPAA
For U.S.-based healthcare clients, certain information handled on behalf of a healthcare provider or other covered entity may constitute Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA).
Where HIPAA applies to our services, Sam’s Virtual Studio will:
Treat PHI as confidential.
Access, use, and disclose PHI only as permitted by the applicable client relationship, contractual requirements, and applicable law.
Use appropriate safeguards to protect PHI from unauthorized access, use, or disclosure.
Limit access to PHI to individuals who require access to perform authorized services.
Follow applicable requirements regarding the reporting of suspected unauthorized access, use, or disclosure.
Cooperate with reasonable client requirements relating to HIPAA privacy and security.
Return or securely destroy PHI when required by the applicable agreement or law, subject to applicable retention requirements.
Business Associate Agreements
Where Sam’s Virtual Studio qualifies as a Business Associate under HIPAA, the applicable healthcare provider or covered entity may be required to enter into a Business Associate Agreement (BAA) with Sam’s Virtual Studio before PHI is handled on its behalf.
The BAA, where applicable, establishes the permitted uses and disclosures of PHI and the privacy and security obligations of both parties.
HIPAA requirements can vary depending on the nature of the services and the parties involved. A BAA does not replace other privacy, security, or contractual obligations that may apply.
3. Administrative & Technical Safeguards
We take reasonable steps to protect client and health-related information through administrative, technical, and organizational safeguards appropriate to the nature of the information and services provided.
These measures may include:
Password-protected accounts and devices
Multi-factor authentication where available and appropriate
Role-based or limited access to sensitive information
Secure communication and file-sharing practices
Use of reputable third-party technology providers
Limiting access to information to individuals who need it to perform authorized services
Secure handling and disposal of information when it is no longer required
We regularly review our workflows and technology practices and may update our safeguards as our business and technology environment evolves.
4. Third-Party Technology Providers
Sam’s Virtual Studio may use third-party technology platforms to perform administrative and operational services for clients.
These platforms may include Google Workspace, Squarespace, and other software or technology providers selected based on the services required by a client.
The privacy and security practices of these providers may be governed by their own terms, privacy policies, security measures, and contractual commitments.
Where a client requires specific privacy or security standards for the handling of health information, we will work with the client to determine whether the technology and workflows being used are appropriate for the services being provided.
5. Client Responsibilities
Healthcare providers and organizations remain responsible for their own privacy and compliance obligations, including determining:
What information may appropriately be shared with Sam’s Virtual Studio
The lawful authority or consent required to collect, use, or disclose personal health information
Which individuals are authorized to access information
Which systems and technology platforms may be used
Whether a written agreement, privacy agreement, data-processing agreement, or BAA is required
Their own patient/client privacy policies and procedures
Clients should not provide Sam’s Virtual Studio with information that is unnecessary for the services we have been engaged to perform.
6. Privacy & Security Incidents
If we become aware of a suspected privacy or security incident involving information handled on behalf of a client, we will take reasonable steps to contain and investigate the incident and will communicate with the affected client in accordance with our contractual obligations and applicable legal requirements.
Where required, the client or responsible healthcare organization may have additional obligations regarding notification of affected individuals, regulators, or other parties.
7. Scope of This Notice
This notice describes Sam’s Virtual Studio's general approach to handling personal health information and Protected Health Information.
It does not constitute legal advice or a guarantee of compliance with PHIPA, HIPAA, or any other privacy legislation. The specific privacy obligations that apply to a client relationship may depend on the nature of the services provided, the type of information handled, the jurisdiction involved, and the contractual arrangements between the parties.
Where appropriate, clients should obtain independent legal or privacy advice regarding their specific compliance obligations.
8. Questions or Concerns
If you have questions about how Sam’s Virtual Studio handles personal information or health-related information in connection with our services, please contact us:
Sam’s Virtual Studio
Email: hello@samsvirtualstudio.ca
Website: www.samsvirtualstudio.ca