On January 28, 2026, marked as Data Privacy Day, the Office of the Information and Privacy Commissioner for British Columbia released a document titled "PIPA and AI Scribes: Best Practices for Healthcare Organizations in BC". Commissioner Michael Harvey framed the reasoning behind it plainly, noting that as healthcare organisations bring AI scribes into their practices, patients need confidence that their sensitive information is properly protected, and that the guidance is meant to provide a roadmap so people can benefit from the technology knowing their rights are respected.
The same day, the Information and Privacy Commissioner of Ontario released its own guidance on AI scribes in clinical settings, covered in What Ontario's New AI Guidelines Mean for Primary Care Clinics. The timing is not a coincidence. Canadian privacy regulators are converging on the same expectations for responsible AI adoption, which means a BC clinic evaluating any AI tool right now is looking at the leading edge of a national pattern, not an isolated regional quirk.
Who the Guidance Covers
British Columbia's Personal Information Protection Act, PIPA, governs private-sector organisations, which includes independent physicians and the large majority of primary care clinics in the province. It does not cover hospitals or health authorities, which fall under a separate act instead.
That distinction is not about clinic size. A five-location private clinic group sits under the same PIPA obligations as a solo practitioner in Vancouver, while a public health authority answers to a different framework regardless of how many sites it runs. If your organisation operates as a private clinic anywhere in BC, this guidance describes what you are expected to do before adopting an AI scribe or any comparable medical AI tool.
The Real Requirement: A Human Who Reviews the Work
The detail in the guidance that should matter most to a clinic is not about consent forms or data flows. It is about accuracy, and who remains responsible when an AI tool gets something wrong.
The OIPC is direct on this point. Generative AI produces probabilistic outputs, not guaranteed factual ones, and the guidance notes that even a small error rate can be serious in a medical setting, the kind of mistake where a name, a medication, or a diagnosis gets transcribed incorrectly. It requires healthcare organisations to have clear, well-communicated policies for active, continuous human oversight of anything an AI tool produces, and it states plainly that introducing an AI tool into clinical practice does not shift accountability. The organisation is still responsible for what ends up in a patient's record, regardless of what generated it.
BC is not alone in landing here. The Canadian Medical Protective Association, the body that provides physicians with medico-legal protection, has issued its own guidance recommending the same core practice: patient consent before an AI tool captures a clinical encounter, a clear explanation of what the tool does, and continuous human review of its output before it enters the record. When a provincial regulator and a national medico-legal body converge on the same requirement independently, that is not a compliance detail to work around. It is the standard the profession is settling on.
The pressure driving AI adoption is real and specific to this province. A December 2025 survey by the OurCare research project found British Columbia was the most improved province in the country on family doctor attachment, rising from 71 percent of residents having a regular provider in 2022 to 82.6 percent in 2025. The same survey found overall satisfaction with the primary care system stayed low nationally, at just 27.8 percent, even in provinces making real progress on access. Attachment and satisfaction are not the same thing, which is why the regulator's emphasis on human oversight matters here: a clinic that adopts AI responsibly is improving the part of the patient experience that attachment numbers alone cannot capture.
How to Introduce AI Tools to Patients
It is worth stepping back from the statutory detail for a moment, because what the guidance describes in practice is patient communication: a clinic's ability to explain, in plain language, what a new tool does and how it handles the information patients share. That kind of explanation is quickly becoming a normal part of how Canadian clinics introduce new technology, and the guidance largely formalises what well-run practices already do.
A useful test for any tool is whether the front desk can describe it to a patient in the time it takes to answer a phone. The clinics that get AI adoption right treat that plain-language explanation as part of onboarding a new system, the same discipline that determines whether any new clinic technology actually sticks with staff and patients rather than quietly getting worked around.
What This Means for Your Technology Choices
The same logic extends to how an AI tool connects to the rest of a clinic's systems. Information that collects in one interface and stays there, disconnected from the record a physician and front desk already rely on, creates exactly the kind of fragmented picture that makes a clinic's privacy obligations, and its human-review obligations, harder to account for honestly.
This is the standard JOUD Health was built around: a single connected system rather than a collection of separate tools that each solve one problem in isolation. Calls are handled by an AI Receptionist that can book, reschedule, cancel, answer general questions, and update a patient's file when something as routine as an address or phone number changes. Check-in and intake sit alongside a patient queue that reflects who is actually waiting, feeding into digital forms and a staff portal with analytics, with confirmations and reminders tuned to each clinic rather than fired on a generic schedule. All of it is designed for Canadian data residency and the privacy law that governs healthcare organisations here, not adapted afterward for a different market.
What BC Clinic Owners Should Do Now
Treat this guidance as an early signal rather than an isolated document. Ask any vendor how their system actually connects to your EMR, not whether it can. Ask what human review step exists before AI-generated content enters a patient's record, and insist on a specific answer, not a reassurance.
For any clinic evaluating medical AI in British Columbia, the ones that navigate this well will be those that let guidance like this shape how technology gets chosen in the first place, rather than treating it as a box to check after the decision has been made.
Elevation Labs builds clinical-grade operational infrastructure for Canadian primary care. Book a demo to learn more.