AI scribes and privacy in Canada: PHIPA, PIPEDA, Law 25 and the 2026 guidance

Why AI scribes became a privacy question

AI scribes listen to a clinical conversation and draft the visit note. Canadian clinicians have adopted them quickly. Canada Health Infoway's national AI Scribe Program enrolled 12,019 primary care clinicians between June 2025 and February 2026, and its independent evaluation, published in June 2026, found same-day note completion rose from 55.9 percent to nearly 75 percent. Ontario created a vendor of record arrangement for AI scribes in June 2025.

A scribe also records everything said in the room, sends it to a vendor for processing, and produces a clinical record. Each of those steps is regulated, which is why privacy commissioners in Ontario, British Columbia and Alberta have all published guidance.

Which law applies to your clinic

PIPEDA is the federal private-sector law. It applies to personal information handled in commercial activity in provinces that have not passed substantially similar legislation, and it still governs information that crosses provincial or national borders. A clinic in Ontario is governed for health information mainly by PHIPA.

What the 2026 guidance asks of a clinic

The Ontario commissioner's January 2026 document is the most detailed. The British Columbia and Alberta guidance points the same way. Read together, they ask six things of a clinic.

Consent

Ontario's guidance states that PHIPA currently has no provision that explicitly permits an AI scribe to collect, use or disclose personal health information without consent. It describes express consent, recorded in the patient's health record, as aligned with several regulatory colleges' requirements. Consent has to be knowledgeable: the patient should know a scribe is being used, why, what goes to the vendor, and the risks, including accuracy. A patient who declines must receive the same standard of care, documented another way. British Columbia's guidance stresses a real choice; Alberta's addresses written consent where a recording device may not be visible.

The privacy impact assessment

The guidance expects a privacy impact assessment before a scribe is introduced, and a review when it changes. Where a tool supports clinical decision-making, legal commentators point to an algorithmic impact assessment as well.

The vendor agreement

Ontario's guidance says the service agreement should prohibit the vendor from collecting, accessing, using or disclosing personal health information except as the clinic authorizes under PHIPA, and should require secure disposal on request. Commentators add breach reporting, security requirements and audit rights. Free trials are covered too: PHIPA obligations apply from the first recording, and the clinic must still be able to provide access and correction after a trial ends.

Recordings and transcripts

A scribe captures every word spoken, and not all of it needs to be kept. Ontario's guidance treats keeping recordings and transcripts as a decision the clinic must justify, with a defined retention period, and secure destruction when they are not kept. British Columbia and Alberta lean toward deletion once the clinician has validated the note.

Training AI models on patient data

This is where the guidance is firmest. Ontario notes that it may be virtually impossible to de-identify a voice recording, and that removing names and health numbers is not enough to meet the very low re-identification standard. Alberta's guidance does not permit model training on personal health information. In practice, a clinic should require its vendor to commit, in the contract, that patient information is never used to train AI.

Accuracy and human review

All three provinces reject autonomous use. A clinician reviews and verifies every AI-generated record before it is used or disclosed, records created or altered by AI should be identifiable as such, and a clinic's policies should stop use of a tool whose performance falls outside an acceptable range. The clinician remains responsible for the record.

Where the data goes

PIPEDA does not itself require personal information to stay in Canada. It holds the organization accountable for information it transfers to a service provider, including one abroad, and expects it to be open with patients about that. Québec requires a privacy impact assessment before health information is communicated outside the province. Many clinics set their own rule that patient information stays in Canada, and they are right to ask every vendor where information is stored and processed, and by whom.

A checklist to take to any AI scribe vendor

1. Which law do you design for in my province, and can I see your privacy impact assessment support?
2. Will you sign an agreement limiting your use of patient information to what my clinic authorizes?
3. Do you train any model on my patients' information, in any form? Put the answer in the contract.
4. Where are recordings, transcripts and notes stored and processed, and for how long?
5. Can I delete recordings once the note is validated, and get proof of destruction?
6. How do you support consent, and recording it in the chart?
7. How are AI-generated notes labelled, and how does review work before they reach the EMR?
8. Who are your subprocessors, and in which countries do they operate?
9. How will you notify me of a breach, and how quickly?

Beyond the visit note

A scribe takes the documentation burden out of the visit itself. The rest of a clinic's administration, from the first enquiry to the faxed referral and the assessment report, sits around the visit and carries the same privacy obligations. Our guide to AI scribes and clinic automation covers what each one takes off a team.

Questions, answered