Canada's provincial DPAs discuss approach to medical AI scribe guidance

Artificial intelligence tools for notetaking and transcription services are becoming more common in medical settings. Canada's provincial data protection authorities are monitoring this proliferation and getting ahead, with each publishing jurisdictional guidelines for the use of transcription tools.

The potential benefits of AI transcription in the healthcare field are significant and far-reaching, with some estimates AI notetaking, or scribe, tools saving clinicians upward of 10 hours per week, according to a trial program of 150 physicians led by OntarioMD. However, the simplification for professionals comes with potential repercussions for patients' sensitive data if tools are not deployed properly.

During a breakout session at the IAPP Canada Symposium 2026, representatives from DPAs in British Columbia, Ontario, and Newfoundland and Labrador broke down their respective guides while unpacking how the statutory variation for the protection of sensitive health data adds wrinkles to recommendations from each province.

Where regulators landed on guidance

The Office of the Information and Privacy Commissioner of Ontario released its AI scribe guidance first among the represented agencies, and it applies to both AI developers and entities seeking to procure and deploy AI scribes. IPC Senior Health Policy Advisor Nicole Minutti said Ontario's guidance "focused on the core functionality" of AI scribes, which is mostly their use for transcription of clinicians' patient notes. 

However, Minutti added the guide was also developed to reflect how AI advances could be further integrated into other medical applications. The potential of AI in clinical settings may evolve to the point where tools perform tasks, such as making patient e-referrals, recommendations for lab tests and for "clinical and decision support," more broadly.

"While we remain alert to this direction of travel, we had to focus our guidance on the core functionality," Minutti said. "Where possible we integrated into our guidance and address some of those emerging concerns that we’re seeing with these broader functionalities."

In British Columbia, the Office of the Information and Privacy Commissioner issued its own AI scribe guidance in January. IPC Policy Analyst Sarah McIntosh said British Columbia's guidance is limited to procurers of AI scribes to assist with ensuring their models comply with the provincial Personal Information Protection Act.

"Although there are many important considerations with these tools, including human rights, equity, we decided to really stay in our lane of privacy and access oversight when we drafted the guidance," McIntosh said. "Our focus was not to discourage the use of these tools, but rather provide guidance for how they can be adopted in a way that is compliant with the law. That also promotes trust for the people whose personal information is being collected by these tools, so we’re hoping that the guidance is a practical roadmap and it provides a useful checklist for organizations."

The Office of the Information and Privacy Commissioner of Newfoundland and Labrador issued its AI scribe guidance after Ontario and British Columbia, using those guides to help generate its own recommendations. IPC NL Access and Privacy Analyst J. Ruth Marks said, while the OPIC NL does not have official "order making" authority, it is charged with enforcing its provincial health information privacy law, the Personal Health Information Act.

The IPC NL's guidance particularly focuses on the relationships data custodians and information managers have with AI scribe services.

"Under (PHIA) there is a specific type of agreement that is required if you are using the services of an information manager, and we also considered other custodians could have some sort of unique relationship with their AI vendor that we have not considered," Marks said. "Having the custodian think about that relationship with their vendor, we wanted to get people thinking about that because that ties in with consent. So if a custodian deems their AI vendor as an agent or an information manager, they don't need expressed consent to use that tool, but consent still has to be knowledgeable, even if it's implicit."

Statutory lines

Several provinces, including Newfoundland and Labrador and Ontario, have sector-specific laws governing how healthcare information can be used. By comparison, British Columbia does not, and instead sensitive health data is treated similarly as other personal data collected by private entities under its private sector privacy law. 

Ontario's Minutti said enforcement powers among provincial DPAs range in their ability to issue enforcement actions, issue corrective orders and recommendations. Despite the disparate authority, she indicated a "fragmented network of instruments" has emerged regulating how the healthcare sector is integrating with AI. Those instruments range from federal requirements contained in the federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act, to provincial statutes, court orders and decisions from administrative tribunals. 

"The health sector's use of artificial intelligence is sometimes characterized as lawless or unregulated by the state, but in fact, it's highly regulated," Minutti said. "I don't think we talk enough about how many gaps AI overlaps, and especially the overlaps that exist in the regulation of this space."

McIntosh said the lack of a dedicated health information-specific law in British Columbia has created a scenario where most primary care clinics are covered under PIPA, while public entities, such as hospitals, are covered under a different law, the Freedom of Information and Protection of Privacy Act. She said, as a result, the two legal frameworks "don’t always talk well together," further complicating how AI scribes can be integrated into healthcare settings. 

"Having that fragmented system in our province, with different privacy and access, as well as applying in different clinical settings, depending on what clinical setting you're in, is not really an ideal setup for the health sector," McIntosh said. 

She added if the province's lawmakers work to pass a health information bill to bring both hospitals and primary care clinics under one law, it will also present an opportunity to develop the best possible outcome for a potential modern regulatory framework around AI integration in healthcare.

"Our office has been calling for a standalone heath information law for over a decade, (because) consistent accountabilities, clearances and permissions, as well as interoperability of health information is crucial," McIntosh said. "Lawmakers in our province really have the opportunity to lead by creating modern health information legislation that not only ties all actors together under one law, but is also built for the modern needs of health information, including AI."