On January 28, 2026, the Information and Privacy Commissioner of Ontario released guidance that every primary care clinic in the province should read before deploying any AI tool in a clinical setting.
The document, titled "AI Scribes: Key Considerations for the Health Sector," was released on Data Privacy Day alongside parallel guidance from the Information and Privacy Commissioner of British Columbia. Alberta and Saskatchewan had already issued similar frameworks. Four provinces have now formally addressed how AI tools must be introduced into clinical environments under their respective health privacy laws, and the message across all four is consistent: AI adoption without governance is not responsible adoption.
While the guidance centres specifically on AI scribe tools that record clinical conversations between physicians and patients during appointments, the principles it establishes apply broadly to any AI system a clinic deploys that touches personal health information. Clinic owners evaluating voice agents, intake platforms, or documentation tools would be well served to read it with that scope in mind.
Why Ontario Regulators Moved Now
The guidance did not emerge from a vacuum. IPC Commissioner Patricia Kosseim, in her remarks at the public event accompanying the release, cited a survey by the Canadian Medical Association and the Canadian Federation of Independent Business in which 90 percent of nearly 2,000 physicians reported a significant administrative burden from documentation, amounting to an estimated 20 million hours annually. Roughly half of those physicians identified AI as a potential solution. Roughly the same proportion also acknowledged real privacy, security, and legal risks.
That tension, between the genuine promise of AI in reducing administrative drag and the legitimate risks it introduces into clinical environments, is precisely what the guidance is designed to navigate. It is the same observation that shaped the development of JOUD Health AI, explored in The Story Behind JOUD Health AI: that the administrative pressure on Canadian clinics is real, and that the tools responding to it must be built with clinical accountability from the ground up.
PHIPA Compliance: What the IPC Now Expects from Clinics
Ontario's Personal Health Information Protection Act governs how health information custodians, including individual family physicians, clinics, and pharmacies, collect, use, and disclose personal health information. The IPC's new guidance clarifies how PHIPA applies to AI tools specifically.
The first and most immediate obligation is a Privacy Impact Assessment before any AI tool is deployed. A PIA requires a clinic to document how the system collects, processes, stores, and discloses patient information, evaluate the associated risks, and put mitigation measures in place. The IPC treats this as a foundational prerequisite; it is the mechanism through which a clinic demonstrates it has considered the privacy implications of what it is introducing before patients are affected by it.
The guidance also draws a clear line on secondary use: patient data processed by an AI tool cannot be used by the vendor for model training or any other purpose beyond delivering the contracted service. For clinics reviewing vendor agreements, this is the clause that requires the most attention. Many AI companies operating in the healthcare sector use patient interactions to improve their models. Under PHIPA, doing so without explicit consent is not permissible, and a clinic that fails to contractually restrict this practice shares accountability for the breach.
Patient Consent Under Ontario's AI Framework
The consent requirements in the guidance impose obligations that go well beyond a signature on a form.
Under PHIPA as interpreted by the IPC, patients must be told what the AI tool is, what it records during their appointment, how their personal health information will be used, who will have access to it, and what the associated risks are. They must have a genuine and unobstructed choice to decline. And the guidance is explicit on one point that has significant operational implications: patients who withhold or withdraw consent must receive the same standard of care as those who consent. A clinic cannot make participation in an AI workflow a condition of receiving care.
In practice, this requires a defined intake process: a brief, plain-language disclosure before the appointment, a mechanism for patients to decline without friction, and a workflow that accommodates non-consenting patients without disrupting care delivery for everyone else. For clinics already operating under pressure, this is not something to improvise.
Evaluating AI Vendors Under PHIPA
The guidance provides a clear framework for assessing whether an AI vendor meets the standard PHIPA requires. Before signing any agreement, clinics should be asking: Where is patient data stored, and is it hosted within Canada? Is patient data used for any purpose beyond delivering the service? What happens to audio recordings after a clinical note is generated, and how long are they retained? Does the vendor have documented procedures for responding to a privacy breach? And will they sign a formal data processing agreement that covers the specific obligations PHIPA imposes?
Ontario has gone a step further than guidance alone. OntarioMD, the Ministry of Health, and the Canadian Medical Protective Association have jointly developed a Vendor of Record procurement programme that evaluates AI tools against specific medico-legal and privacy requirements before approving them for use by Ontario physicians. As of early 2026, 18 vendors have been approved through the programme, with a second intake underway. For Ontario clinics, VOR qualification is a meaningful indicator that a vendor has been evaluated against a defined standard rather than simply self-reporting compliance.
A vendor that cannot answer the foundational questions clearly, or that resists committing to them contractually, is not a vendor a clinic should be trusting with personal health information. The guidance is non-binding in that it does not carry the force of a regulation, but it reflects the IPC's interpretation of existing law and would carry significant weight in any future enforcement investigation or breach proceeding.
Human Oversight Is Not Negotiable
Across every provincial AI framework released in early 2026, one requirement appears without exception: a physician must review AI-generated clinical notes before they enter the medical record.
This is not a scepticism about AI capability. It is a recognition that AI systems produce errors, and that the consequences of unreviewed errors in a clinical record are serious enough to require an accountability step at the point of entry. The physician who signs off on a note is accountable for its contents, regardless of how it was generated.
AI tools that reduce documentation time while removing the review step are not compliant with the guidance. The efficiency gains that make these tools worth adopting must be structured around human oversight, not in place of it.
What Clinic Owners Should Do Now
The January 2026 guidance is a baseline. Commissioner Kosseim signalled clearly that regulatory expectations around AI governance in healthcare will continue to evolve as adoption accelerates and the IPC learns more from real-world deployments.
Clinics that treat this guidance as a checklist to satisfy will find themselves revisiting it as expectations rise. Clinics that treat it as a design standard for how they evaluate and introduce AI tools will be better positioned throughout that evolution. The practical steps are clear: conduct a PIA before any deployment, establish a defined consent process, scrutinise vendor agreements for secondary use restrictions and data residency commitments, and ensure human review is built into every AI-assisted clinical workflow.
The administrative pressure driving AI adoption in Canadian primary care is not going away. The clinics that navigate it responsibly will be the ones that took the governance question as seriously as the efficiency question from the start.
If you would like to see how JOUD Health AI approaches these requirements, contact us.