Canada's federal, provincial and territorial privacy commissioners and ombuds published a joint resolution on October 29 calling for the responsible use of artificial intelligence in health and health research. The specific ask is the part to read twice: they want all relevant parties who develop, procure and use AI systems in health care to be legally required to establish effective AI governance and accountability frameworks.
Note the verbs. Not just developers. Procurement and use are in there, which is where a four-person clinic sits.
What the resolution asks for
- Legally required governance and accountability frameworks for those who develop, buy and use AI in health care.
- A privacy-by-design approach to AI systems used in health contexts.
- Updated national research ethics policies, with the regulators calling on Canada's health research agencies to provide more detailed guidance for the ethical conduct of AI-enabled research involving human participants.
- Capable research ethics boards, able to assess privacy alongside other legal, social and ethical issues.
- Public sharing of outcomes from AI research in health.
The regulators also committed to keep advocating for legislation and to coordinate among themselves on enforcement, guidance and public education. Two dates for accuracy: the resolution carries a September 15 adoption date and was published on October 29. Nothing is law today, and a resolution is advocacy rather than regulation.
Why this lands on small businesses
"Health care" reads as hospitals and health authorities. In practice, a large share of Canadian health care is delivered by small private businesses: dental practices, physiotherapy and chiropractic clinics, psychology and therapy practices, optometrists, massage therapy, veterinary clinics, pharmacies, medical aesthetics. Many employ fewer than ten people.
And a great many of them adopted AI in the last year, usually in the form of an AI scribe: a tool that listens to the appointment and drafts the clinical note. The appeal is obvious, because documentation is the worst part of the day. But consider what that tool is doing. It records a conversation containing health information, which is the most sensitive category there is. It sends that recording to a third party for processing. It generates a clinical record that goes into a patient's file and may inform treatment. It may retain the audio. And the practitioner, not the vendor, is accountable for the record.
That is precisely the arrangement the resolution is pointing at, and it compounds with the OPC's recent confirmation that voiceprints are sensitive biometric information. A clinic running an AI scribe is holding health information and voice data about patients, usually under terms nobody has read.
What to actually do
- List the AI in your practice. Scribes, transcription, triage chatbots, booking assistants, imaging tools, anything in your practice-management software that was switched on by an update.
- Ask each vendor four questions in writing: where is the data processed and stored, is the audio retained and for how long, do you train models on our data, and can we have it deleted. Do not accept a sales answer.
- Check your consent. Patients should be told an AI tool is involved in recording or documenting their appointment, in the moment, not in a poster at reception. This is also the point the OPC made about transparency needing to be understandable and timely, not merely available.
- Keep a human accountable for the record. The practitioner reviews and signs off on the note. An unreviewed AI-drafted clinical record is a liability with a diagnosis in it.
- Write the one page now. Which tools are approved, what may never go into them, who signs off, what happens if a note is wrong. That one page is a governance framework at clinic scale, and it is what a regulator would ask to see.
- Check your college's position. Regulated professions have their own record-keeping and consent rules, and several colleges have issued AI guidance that is stricter than privacy law.
The takeaway
This resolution is not binding, and Canadian AI legislation has a history of not arriving. But every regulator in the country has now jointly said that buying and using AI in health care should carry a governance obligation, which is a clear signal of where scrutiny goes next. For a small practice the work is modest and overdue anyway: know which tools are listening, know what happens to the recordings, tell patients, and keep a human signing the note.