Alberta AI Scribe Rules: CPSA Advice, the Health Information Act and the OIPC PIA Guidance

Five things, and CPSA has been more direct than most Colleges about the one that trips clinics up: consent.

The Advice to the Profession: Artificial Intelligence in Clinical Practice, published October 2025 and last updated March 2026, opens with the statement that regulated members should proceed with caution and remain professionally accountable for all clinical decisions and documentation. Its key points are, in the College's own order: update or submit a PIA to the OIPC when introducing any AI tool into clinical practice, including for documentation; implied consent is not recommended, so when using any AI tool in patient care including AI scribes, clearly inform patients and obtain and document meaningful informed consent, including transparency about benefits and limitations and about the member's responsibility for clinical decisions; document how and when AI is used in the patient record, especially when it informs diagnosis, treatment or clinical notes; review, verify and remain fully accountable for all clinical decisions and documentation regardless of whether AI tools are used; and minimise harm by critically reviewing all AI generated content for accuracy, bias, hallucinations and clinical relevance before it enters care or documentation.

Two further points are specific to Alberta. CPSA defines a PIA in the advice as a formal process required under the Health Information Act to identify and mitigate privacy risks when new technologies including AI tools are implemented, which must be updated with or submitted to the OIPC. And it asks that AI generated information form part of the patient record and remain accessible to patients, which means the scribe's output is not a working draft that lives outside the chart.

The documentation point deserves attention because it is unusual. Ontario's CPSO and BC's CPSBC require consent and review; CPSA additionally expects the record to show that a scribe was used. A short standard line in the note, stating that the visit was documented with the assistance of an AI scribe with patient consent and that the physician reviewed and edited the note, satisfies it and also creates the audit trail an OIPC investigation would want. Compare the Ontario and British Columbia positions, which stop short of this.

Through three sections that together make Alberta the most procedural province in Canada for scribe adoption.

Section 64: the privacy impact assessment. A custodian must prepare a PIA and submit it to the Commissioner for review and comment before introducing a new administrative practice or information system relating to the collection, use and disclosure of individually identifying health information, and before changing an existing one. A scribe is a new information system; a scribe update that changes what is collected or where it is stored is a change to an existing one. The PIA must identify and review risks and the measures that protect privacy. The OIPC does not approve PIAs, it reviews and comments, but the duty is to submit before use, and the OIPC's September 2025 guidance sets out what an AI scribe PIA must cover. The Alberta Medical Association publishes a PIA checklist and PIA resources for clinics.

Section 66: the information manager agreement. A custodian must enter into a written agreement with an information manager, in accordance with the regulations, before providing health information to it. The information manager may then receive information without patient consent for the purposes the agreement authorises, may use or disclose it only for those purposes, must comply with the Act, and the custodian remains responsible for compliance in respect of the information it provided. A scribe vendor is an information manager. A click through terms of service is not a section 66 agreement unless it contains what the Health Information Regulation requires, and a vendor that wants to train on recordings is asking for a purpose the custodian has no authority to grant.

Section 60 and 60.1: safeguards and breach. The custodian must take reasonable steps to maintain administrative, technical and physical safeguards. Affiliates must notify the custodian as soon as practicable of any loss of or unauthorised access to or disclosure of individually identifying health information, and the custodian must in turn notify the Commissioner, the Minister and the individual where there is a risk of harm. The vendor's incident is the custodian's notification.

The Act says little about data residency in terms, and the 2025 amendments did not add a residency rule. The OIPC's guidance treats cross border storage as a risk to be justified in the PIA, and the OIPC's own position is that Alberta health information should not be subject to foreign legal process without the custodian having assessed and accepted that risk. In practice a PIA proposing storage outside Canada will draw comments, and most Alberta clinics choose Canadian hosting to avoid writing that section. The vendor's HIPAA language is irrelevant to all of this; as our HIPAA and AI page explains, HIPAA is a United States statute that neither the OIPC nor CPSA will read.

The September 2025 guidance is written as a set of questions a custodian must answer in the PIA. Its positions are the strictest in the country, and a clinic that has built to the OIPC's standard has built to every other province's.

• Necessity, not efficiency. Collection of health information is authorised only where it is required to provide a health service, determine eligibility or manage the custodian's internal operations. Saving the clinician time is not a purpose the Act recognises, so the PIA must explain why recording the encounter is necessary to produce the record, and must minimise what is collected.
• Consent in writing, or devices visible. The guidance prefers written consent and accepts, at minimum, that recording devices be visible and explained. CPSA goes further and says implied consent is not recommended. Do both: explain, ask, document.
• Delete the audio. Recordings should be deleted after transcription and after the clinician has validated the note. Retention beyond that needs a justification in the PIA.
• No secondary use. The vendor is an information manager acting only for the custodian's purposes. Product improvement, model training and analytics on identifiable or derived data are outside those purposes.
• Human review, specifically for known failure modes. The guidance names session mixing, where content from one patient appears in another's note, and mistranscription. Review is not a formality; it is the control for those failures.
• Contracts that preserve custodial control. The section 66 agreement must require compliance with the Act, secure destruction, breach notification and limits on subcontractors, and must not let the vendor change how information is handled without the custodian's agreement.
• Algorithmic impact assessment where the scribe advises. If the tool suggests diagnoses, orders or codes rather than transcribing, an AIA sits alongside the PIA.

These map onto the same artefacts the IPC in Ontario and the OIPC in BC ask for, with the difference that in Alberta the PIA is a statutory filing rather than a recommended practice. The procurement questions in our AI scribe checklist produce the evidence the PIA needs; the policy skeleton in the AI policy template covers the rest of the clinic's AI use.

There is no Alberta Health approved vendor list for community clinics, and it is important to say so plainly because vendors imply otherwise. What exists is the following.

The Alberta Health Services Jenkins scribe. Built by University of Alberta emergency physicians with AHS and the Alberta Machine Intelligence Institute, Jenkins was piloted from November 2024 in 10 emergency facilities with 58 physicians and over 6,700 sessions, then expanded to more than 850 emergency physicians. By March 2026 it was in 81 emergency departments with 373 physicians trained and nearly 31,000 sessions recorded, and was being tested by 30 family physicians. The platform has been released as open source. It is governed by AHS's own PIA and is not available for purchase by a private clinic, but it is the reference point for what a provincially assessed scribe looks like.

Canada Health Infoway's pre-qualified list. Nine vendors, Autochart.AI, AutoScribe (Mutuo), CareWay (MEDFAR), Empathia AI, Mika AI (Mikata), NexusAI (WELL Health), Pippen, Scribeberry and Tali, were pre-qualified nationally, and Alberta primary care clinicians could take a funded one year licence if they signed by December 31, 2025. The Alberta Medical Association points members to this list through the OMD AI Knowledge Zone. CPSA's September 2025 note is the caveat: the OIPC has not reviewed these products, and the custodian still owes a PIA.

The Alberta Medical Association. The AMA publishes AI principles covering bias, AI literacy, audit trails and clinician oversight, implementation and safety, data security and ethics, evaluation and environmental impact, together with a PIA checklist and privacy resources. It does not evaluate or approve vendors. Alberta Health Services, Covenant Health and other facilities maintain their own AI policies that practitioners with privileges must follow.

So the honest answer to "which scribes are approved in Alberta" is: none for community practice, nine pre-qualified nationally, one built and assessed by AHS for its own use. The shortlist most Alberta clinics work from is the Infoway nine filtered by Canadian hosting, Alberta friendly contract terms and EMR fit. Which of those publish Canadian residency and CAD pricing is on our best AI scribe in Canada guide; the wider market is on the AI medical scribes comparison.

Written or clearly documented verbal consent before the first recording, a note in the chart that a scribe was used, and a visible device. That combination satisfies CPSA, the OIPC and the Health Information Act at once.

Start from CPSA's definition of informed consent in the advice: a process by which the patient is given clear information about the nature, purpose, risks, benefits and alternatives of the intervention, including AI tools where feasible, so they can voluntarily decide. Obtaining verbal or written consent is the physician's responsibility and the consent process must be documented in the record. CPSA's Informed Consent standard of practice applies. The advice also introduces the idea of notification and explanation, a basic description of the tool's purpose, how it contributes to care and its limitations, as the foundation of meaningful consent.

What to say: that an AI tool will record and summarise the visit; which company processes the recording and where the data is stored; that the recording is deleted once the note is finalised; that the physician reviews and edits every note; that declining changes nothing about the care provided; and that the patient can withdraw at any time. If someone else is in the room, they are recorded too. The OIPC's preference for written consent can be met with a one page form at first use, with verbal reconfirmation at later visits recorded in the note.

What to write in the chart: one standard sentence recording that the note was prepared with an AI scribe with the patient's consent and reviewed by the physician. This is the CPSA documentation expectation, it is the audit trail for the OIPC, and it makes the scribe's use visible to the patient when they access their record, which CPSA also expects.

Do not let the scribe file anything unsigned. The OIPC's named failure modes, session mixing and mistranscription, are only caught by a clinician reading the whole note. Configure the tool so that notes are drafts until signed and audio is deleted on signature. The workflow, and what to look for when reading a draft, is described on our ambient scribe page.

1. Confirm you are the custodian and who your affiliates are. In a group practice with a professional corporation, decide whose PIA this is before anyone writes it.
2. Shortlist against the OIPC's questions, not the demo. Canadian hosting, deletion on signature, no secondary use, breach notification, subcontractor disclosure, and a willingness to sign a section 66 agreement in your form rather than theirs.
3. Sign the information manager agreement. It must meet the Health Information Regulation and must preserve your control over changes. The vendor's standard terms are the starting point, not the end.
4. Write and submit the PIA before the first recording. Use the OIPC's AI scribe guidance as the table of contents and the AMA checklist as the quality check. Add an algorithmic impact assessment if the tool suggests anything clinical.
5. Build the consent form, the chart line and the staff script. Train everyone who will be in a room with the device running.
6. Pilot with measurement. Two willing clinicians and one sceptic, four weeks, with a sample of notes audited against the recording before deletion. Session mixing and mistranscription rates are the numbers that matter, followed by after hours time. The AI scribe ROI calculator converts the time figure into a break even.
7. Diarise the PIA update. Any vendor change to collection, storage or purpose reopens section 64. Put a clause in the agreement requiring notice, and a review date in the policy.

Published Canadian pricing for the vendors most Alberta clinics consider ranges from free tiers to roughly 100 to 150 dollars per clinician per month; what each publishes is on the scribe pricing comparison. Budget the PIA and the agreement review as a one off cost alongside it; they are the part of the Alberta process that a subscription price does not include.

Alberta asks more of a clinic before the first recording than any other province: a statutory PIA, a compliant information manager agreement, documented consent and a note in the chart. It gives the clinic less help in return: no provincial vendor list for community practice, an Infoway list the OIPC has explicitly not reviewed, and a College that has said in writing that the technology is unregulated and the member is accountable.

An independent advisor with no vendor commissions does the parts of that work a busy clinic cannot. We run the vendor comparison against the OIPC's questions, negotiate the section 66 agreement so that it actually preserves your control, draft the PIA to the OIPC's guidance so that the review produces comments rather than an order, and set up a pilot that measures the failure modes the OIPC named. The result is a scribe that saves the time the Infoway evaluation promised without a filing gap that surfaces the first time something goes wrong.

That is what our vendor selection engagement does for scribes and our AI governance and compliance engagement does for the PIA, the agreement and the policy. To talk through where your clinic is, book a call.