Transferring Patient and Client Records When Selling a Practice in Ontario

Patient and client records are often the most sensitive — and most legally complicated — asset changing hands when a professional practice is sold in Ontario. Unlike equipment or a lease, records contain personal information that the seller was never free to treat as their own property to dispose of however they liked, and that constraint doesn't disappear just because a sale is happening.

Whether you're selling a medical clinic, a dental practice, a law firm, or an accounting practice, the underlying question is the same: on what legal basis can these records move to a new owner, and what do the people they're about need to be told?

Two Different Privacy Frameworks, Depending on the Records

• Health records held by a health information custodian (a physician, dentist, clinic, and similar) are generally governed in Ontario by health-specific privacy law that deals directly with situations like a practice sale, transfer of custody, or closure.
• Other professional and business records — a law firm's client files, an accounting firm's client records, a general business's customer information — are generally governed by broader Canadian privacy principles that apply to personal information held by organizations, alongside any profession-specific confidentiality obligations (a lawyer's duty of confidentiality to clients, for example).

Both frameworks share a common thread: personal information generally can't simply be handed to a new owner as though it were a business asset like inventory, without regard to the individual's own interest in it. But the specific mechanics — what notice is required, whether consent is needed, what rights the patient or client has — differ enough between health records and other professional records that they shouldn't be treated as interchangeable.

The General Shape of a Compliant Transfer

Regardless of which framework applies, a well-run practice sale typically works through the same broad sequence:

1. Identify what records exist and who they're about. This sounds obvious, but a sale is a natural moment to discover records that are outdated, duplicated, or unclear in ownership (for example, records from a departed associate or a prior ownership structure).
2. Determine the correct legal basis for transferring custody to the buyer. For health records, this is often addressed through provisions that allow custody to move to a successor when a practice is sold or closed, generally paired with an obligation to give patients reasonable notice and an opportunity to make other arrangements. For other professional records, client consent or an existing engagement relationship may be the relevant basis instead — this is exactly the kind of detail that varies by profession and shouldn't be assumed.
3. Give proper notice. Patients or clients are generally entitled to know that their records are moving to a new custodian or firm, and — particularly for health records — to have the option of directing their records elsewhere instead.
4. Address security and access during the transition itself. Records shouldn't sit in an ambiguous state where it's unclear who is responsible for safeguarding them between signing and closing.
5. Build the terms into the purchase agreement. Who is responsible for notifying patients or clients, who bears the cost, and what happens to records for patients or clients who choose not to move with the buyer are all things a purchase agreement should address explicitly rather than leave implicit.

Common Misconceptions

• "Records are a business asset like any other, so they transfer with the sale automatically." Personal information carries its own legal constraints independent of who owns the underlying business — a purchase agreement can describe records as part of what's being acquired, but that doesn't override the privacy obligations attached to them.
• "As long as the buyer signs a confidentiality clause, I don't need to notify patients or clients." A confidentiality obligation between buyer and seller is not a substitute for whatever notice or consent obligations exist toward the actual patients or clients whose information is involved.
• "This is the same regardless of whether it's a health practice or a law firm." The specific rules differ meaningfully by profession and by the type of information involved — don't assume a process that worked for one type of practice applies identically to another.

Frequently asked questions