CASLPO compliance: what we have, what is in flight, and what is on the roadmap
Live status of every CASLPO standard the Vochella product touches - mapped to Ontario's PHIPA + HCCA statutory framework and to the equivalent US obligations. Status reflects the codebase as of April 2026.
1
Live
2
In progress
1
Roadmap
This page is descriptive, not legal advice. It is generated from the same compliance rule engine that runs in production. For binding obligations, see the Business Associate Agreement, Privacy Policy, and Terms of Service. CASLPO registrants remain responsible for their own professional obligations.
The four CASLPO standards we map to product
Each card spells out the CASLPO obligation, what is shipped, what remains, the Ontario statutory basis, the US parallel, and the exact codebase paths.
Standard 4 - Consent
Consent obtained and documented at every intervention phase
In progress
CASLPO requires informed consent for each phase of intervention - screening, assessment, treatment, consultation, education, and discharge - not only at intake. Standard 4 requires the registrant to document every consent received.
What we built
•New consent_records.intervention_phase column scopes a row to a specific phase
•Six new ConsentType values (intervention_screening through intervention_discharge) with verbatim copy versioned and SHA-256 hashed
•Consent ledger panel on every client profile - SLPs see active vs. withdrawn consent for every phase at a glance
•framework_basis column tags each row with the legal frameworks invoked (e.g. {CASLPO, PHIPA, HCCA-informed})
What remains
•Soft-warn modals when an SLP starts assessment / treatment / discharge without an active phase consent (P0 follow-up)
•Consent receipt email copy update to call out the phase being consented to
Ontario legal basis
PHIPA s.18 (knowledgeable consent)
HCCA s.10 (informed consent to treatment)
CASLPO Standards 1 + 4
US parallel obligation
HIPAA Notice of Privacy Practices + state informed-consent statutes + IDEA 34 CFR 300.300 (separate consent for evaluation vs. initial provision of services).
Two separate recording consents: data handling and treatment use
In progress
PHIPA 'knowledgeable' consent (collect / use / retain / disclose recordings) and HCCA 'informed' consent (use the recording during care) are legally distinct. The recording flow must capture both explicitly.
What we built
•New ConsentType values: recording_data_handling (PHIPA s.18) and recording_intervention_use (HCCA s.10)
•Ontario-specific consent copy with explicit PHIPA + HCCA statutory citations
•Backfill migration clones legacy voice_recording rows as recording_data_handling so existing clients are not blocked
•Two-checkbox dual-consent UI design ready for rollout (replaces the single-banner pattern)
What remains
•Wire the dual-checkbox modal at the upload-practice-audio entry point and reject uploads missing either consent
•Update the Privacy Policy + recording consent forms to reflect the two-consent split (counsel review)
Ontario legal basis
PHIPA s.18 - knowledgeable consent for collection / use / retention
HCCA s.10 - informed consent for the use of recordings during care
US parallel obligation
HIPAA 45 CFR 164.508 authorization + state informed-consent statutes for AV recording in healthcare. IL BIPA voiceprint and WA MHMDA explicit-consent rules layer on top via the existing jurisdiction overrides.
Substitute decision-maker hierarchy on the client profile
RoadmapTarget Q3 2026
CASLPO documentation must reflect who has consent authority - the SDM hierarchy under HCCA s.20, including the basis of authority (parent, court-appointed guardian, attorney for personal care) and any custody or guardianship order on file.
What we built
•client_substitute_decision_makers table with relationship, authority_basis (HCCA / IDEA / FERPA / state surrogate / capable-minor), rank, custody/guardianship document URL, effective dates, and verification timestamp
•Backfill migration imports existing parent_guardian_name / parent_guardian_email rows as a primary SDM (rank 1, basis hcca_default)
•Row-level security: SLPs manage SDMs only for their own clients; clients can view their own SDMs
•Capable-minor flag (clients.is_capable_minor) already in place for the PHIPA edge case where the minor is the consent authority
•Tie consent_records.metadata.sdm_id at grant time so each consent is bound to the authority on record at that moment
•Jurisdiction-aware authority-basis picker (HCCA ladder for ON, personne autorisée for QC, IDEA 300.30 / FERPA eligible-student for US schools)
Ontario legal basis
HCCA s.20 - SDM hierarchy
PHIPA s.21 - capable minor
Civil Code of Quebec art. 11-25 - authorized person
US parallel obligation
State surrogate-decision-maker statutes; IDEA 34 CFR 300.30 'parent' definition for school-based services; FERPA eligible-student status at age 18; conservator / guardian / power-of-attorney for adults with disability.
AI-drafted clinical output requires a clinician attestation
Live in production
CASLPO Documentation Standard 1: records must demonstrate 'what the registrant did and why.' For AI-drafted clinical output (progress reports, plus SOAP notes drafted before AI drafting was retired), the registrant must demonstrably review, edit, and approve the output before signing.
What we built
•SOAP drafting no longer uses AI at all (retired 2026-08): notes are built from session data plus the clinician's verbatim dictation, so new notes never trigger the attestation gate
•ai_review_attested_at / _text / _hash / _version columns on soap_notes, progress_reports, and ai_summaries
•Mandatory attestation modal blocks the sign action when ai_generated = true: 'I have reviewed and edited this note. It accurately reflects my clinical judgement and the services I provided.'
•Verbatim attestation text + SHA-256 hash + version + timestamp persisted alongside the note
•Database trigger refuses to sign an AI-drafted note without an attestation (defence-in-depth against stray service-role writes)
•Reusable AiAttestationModal component ready to wire into progress reports and AI summaries
What remains
•Render the attestation line on PDF exports (lib/iepPdf.ts and lib/progressReportPdf.ts)
•Application-side audit log emit for ai_clinical_output.attested events
Ontario legal basis
CASLPO Documentation Standard 1
US parallel obligation
HIPAA documentation, ASHA Code of Ethics (Practitioner Responsibility), CMS clinician attestation for billing, AMA AI-scribe guidance, state licensure record-keeping rules.
Where it lives in the codebase
supabase/migrations/037_ai_attestation.sql
components/slp/AiAttestationModal.tsx
lib/domain/aiAttestation.ts
app/(slp)/soap-note/[id].tsx
Already in production - PHIPA, PIPEDA, and beyond
Outside the four standards above, the broader Ontario / Canadian / cross-border compliance posture is already running.
Jurisdiction-aware consent engine
Every consent prompt resolves from clinic country + province with a 3-level fallback. Ontario clinics see PHIPA + HCCA copy automatically.
lib/domain/jurisdictionRules.ts
Verbatim consent + SHA-256 hash + version
Every consent grant stores the exact text, a tamper-detection hash, and a version. Version bumps trigger automatic re-consent.
consent_records (text, hash, version)
Consent receipts + withdrawal pipeline
Granting consent triggers a receipt email. Withdrawals are processed daily and propagate to downstream artifacts.
Every PHI read and non-TPO disclosure routes through the data adapter and lands in phi_access_logs / disclosure_logs.
.cursor/rules/audit-logging.mdc
Generative AI under AWS BAA (Bedrock + Claude)
All generative AI calls route through AWS Bedrock under the AWS BAA. Speech-to-text (clinician dictation, practice word checks) runs through a BAA-covered transcription service that processes audio transiently and never trains on it. No PHI is sent to any non-BAA provider.
supabase/functions/_shared/bedrock.ts
Capable-minor consent path (PHIPA)
Ontario PHIPA allows capable minors to consent on their own behalf. The SLP records this with an explicit toggle on the client profile.
clients.is_capable_minor
Questions on a specific CASLPO standard?
We are happy to walk Ontario SLPs and their counsel through the controls, receipts, and audit trails behind any of the four standards above.