Using AI with patient data responsibly
AI can take hours of paperwork off your team, and the same privacy rules still apply. Five rules cover most of it: a clinician reviews every AI draft, the vendor never trains on your data, you know where the data is processed, patients are told in simple words, and in Québec, patients are told when a decision about them is made only by automated processing.
What you must do
A clinician reviews every AI draft.
AI makes mistakes that read like facts.
Nothing AI writes goes into the chart or to a patient until a clinician has read and approved it. IPC Ontario, AI Scribes
The vendor does not train on your data.
Training uses your patients’ information for someone else’s purpose.
Put it in the agreement: no training, no secondary use, for any model.
Know where the data is processed.
Where the data goes decides which laws apply.
Ask for the country, and the province for Québec clinics. Moving information outside Québec needs an assessment first. Québec health information act
Tell patients in simple words.
Patients trust what they understand.
Your privacy statement says which tools you use, what they do, and that a clinician reviews the results. Our templates include a paragraph for it.
In Québec, disclose decisions made only by automated processing.
It is the law in Québec.
Tell the patient, and let them ask for a person to review the decision. Private sector act, section 12.1
Assess before you adopt.
A short assessment now saves a long investigation later.
Check consent, recordings, retention and the vendor agreement before go-live. IPC Ontario, AI Scribes
Why it matters
AI does not change who is responsible for patient information. Your clinic is. Clear rules let your team use AI with confidence, and let you answer a patient’s question in one sentence.
Common mistakes
- Letting an AI draft into the chart unreviewed during a busy clinic day.
- Using a free tool whose terms allow training on what you type.
- Recording visits without telling patients.
How PulseAI helps
- Nothing generated for a patient reaches them until a clinician has reviewed it and signed.
- Patient data is never training data, for any model, ours or anyone else’s.
- Canadian clinics are stored and processed in Canada. Québec clinics are stored and processed in Québec, on servers in Montréal.
See how we protect your data on the Trust Center.
Questions, answered
Do I need patient consent to use an AI scribe?
Tell patients clearly and get the consent your law requires, especially for recordings. The IPC’s 2026 guidance on AI scribes sets out what Ontario expects.
Can an AI vendor train on my patients' data?
It should not. Put a no-training, no-secondary-use term in the agreement.
What is Québec's rule on automated decisions?
When a decision about a person is made only by automated processing, you must tell them, and they can ask for the information used and for a person to review it.
Your next step
Give every patient a clear privacy statement, and keep their acknowledgement on file.
Comparing vendors? Request our security package.
This page explains common obligations in plain language. It isn’t legal advice. Check with your privacy officer or lawyer for your situation.
Your privacy responsibilities: the other pages
- OntarioDuties of a health information custodian.
- QuébecLaw 25 and the health information act.
- Rest of CanadaPIPEDA and provincial health acts.
- United StatesDuties of a covered entity.
- Working with vendorsBAAs and service agreements.
- If something goes wrongBreach basics, and who to tell.
- Patient privacy templatesFree statements and acknowledgements.
How we protect your patients’ information is on our Trust Center.