Updated September 25, 2026: every legal and factual statement in this article was re-checked against the primary source and corrected where needed.
If your clinic has quietly swapped typed notes for an AI scribe that listens in on the visit and drafts the chart note for you, you've already made a privacy decision — whether or not anyone signed off on it. On January 28, 2026, Ontario's Information and Privacy Commissioner (IPC) published new guidance, AI Scribes: Key Considerations for the Health Sector, along with a companion checklist, aimed squarely at that decision. It's the clearest signal yet of how the regulator expects clinics to govern these tools under the Personal Health Information Protection Act (PHIPA) — and it's worth reading before your next vendor renewal, not after an incident.
What the guidance actually asks for
The core message is simple and easy to miss in the excitement of a new tool: your obligations as a health information custodian do not pause just because a task has moved to an AI system. PHIPA still governs the collection, use, and disclosure of personal health information, and you remain accountable for how it's handled, even when a vendor does the processing. A few specifics stand out.
Need first, tool second. The guidance tells custodians to start from their operational needs and ask whether an AI system is the best way to meet them. AI systems, it says, "should not be used simply because they are available or because other custodians are using them." PHIPA's necessity rules still apply: no more personal health information than is reasonably necessary for the purpose. If you can't articulate why the tool needs to capture what it captures, that's a governance gap.
Consent that actually informs. Patient consent is generally required, and it has to be real consent — patients need to understand what's being recorded, that a third-party vendor is involved, and what the privacy risks are. Just as important: a patient who declines or withdraws consent has to receive the same or similar level of care as one who agrees. There's no "AI scribe or the door" option.
No quiet model training. Vendors may ask to use your patients' recordings or transcripts to train or improve their models. The guidance is clear that you can't agree unless PHIPA gives you the authority to disclose: in practice, the patient's consent, or data that has been effectively de-identified. It also warns that it "may be virtually impossible to de-identify a voice recording," and that transcripts carry many of the same risks, so a vendor's promise that training data is anonymous deserves hard questions.
Decide retention deliberately. The guidance doesn't order you to delete raw audio and transcripts, but it makes you decide. Keeping them has to be justified against PHIPA's necessity rules, your college's record-keeping expectations and patients' right to access what you keep; you may well conclude the validated summary in the EMR is enough. If you keep them, set a retention period and keep them no longer than the purpose requires. If you don't, dispose of them securely. What you can't have is a permanent shadow archive nobody chose.
A human reads it before it's real. AI-generated notes need clinician review before they land in the record — the control that catches hallucinated details, mistranslations, and the quiet creep of automation bias, where a clinician starts trusting the machine's draft more than their own memory of the visit.
Governance you can point to. The IPC recommends an AI governance structure with real teeth: a committee, or a named person in a smaller practice, accountable for adopting a tool, overseeing it, and pausing it when its output turns inaccurate, biased or harmful; regular, documented monitoring; and a privacy impact assessment before go-live, reviewed as use changes. PHIPA itself doesn't require a clinic to complete a PIA; the IPC recommends one as the way to show due diligence if a breach or complaint arrives. And whether your vendor acts as your agent or as an electronic service provider, you stay responsible for the personal health information in your custody or control. A contract can bind the vendor. It can't hand them that responsibility.
Why this matters beyond the obvious audience
It's tempting to read this as a family-medicine problem. It isn't. Any custodian using dictation-plus-AI — specialists, allied health, walk-in clinics, virtual care providers — is squarely in scope, and so is anyone selling these tools into Ontario care settings. Vendors should expect sales conversations to include questions lifted straight from the IPC's checklist: what happens to the audio, who can access it, what's in the contract, how is bias monitored. A clinic that can't answer those internally will struggle to answer them for a vendor, or a patient who asks.
This is also a preview. The IPC says much of the guidance has broad application for AI systems used in Ontario's health sector, not only scribes. The governance pattern here — necessity, informed consent, no secondary use without authority, deliberate retention, human review, documented oversight — is a sound bet for what the IPC will look for the next time a new category of clinical AI shows up.
What to do now
- Inventory what's actually in use — including tools individual clinicians adopted on their own without procurement's knowledge.
- Rewrite consent language and the front-desk workflow so patients are told, in plain terms, what's recorded and why.
- Pull the vendor contract and check it against the basics: no model training on your data, defined retention and deletion timelines, breach notification terms, and subcontractor controls.
- Add the AI scribe to your breach protocol: PHIPA requires you to notify affected patients at the first reasonable opportunity, to notify the IPC when the prescribed thresholds are met, and to count every theft, loss and unauthorized use or disclosure in the annual statistics report due to the IPC by March 1.
- Decide, and write down, whether you keep raw audio and transcripts at all. If you do, give them their own retention period, keep them only as long as the purpose requires, and check it against your college's record-keeping guidance. If you don't, confirm the vendor deletes them securely.
- Name a person or committee who owns AI oversight, with actual authority to pause a deployment if something looks wrong.
- Run a privacy impact assessment before you scale to a new site or a new use case, not after.
Mosaic helps clinics and healthtech vendors work through exactly this list using a proprietary, standardized methodology built around Ontario's health privacy regime — turning a regulator's guidance document into a governance framework you can actually operate day to day. The work is expert-led throughout, and it's built so the paper trail holds up, not just looks good in a binder.