British Columbia AI Scribe Rules: CPSBC, PIPA, FIPPA and the BC Scribe Programme

The College's position is a single paragraph inside its AI guideline, and every word of it is operative.

CPSBC's professional guideline Ethical Principles for Artificial Intelligence in Medicine, effective April 11, 2024 and revised to version 1.2 on April 1, 2026, states that the six principles also apply to the use of AI scribes, that informed consent must be obtained from the patient before using an AI scribe, that licensees must be aware if the software stores audio recordings and if so must follow the Photographic, Video and Audio Recording of Patients practice standard, that licensees are responsible for reviewing documentation produced by the AI scribe prior to its entry into the medical record, that they are accountable for ensuring the note is a correct representation of the patient encounter, that AI scribes do not replace clinical judgment for proper medical record keeping, and that licensees are liable for errors made by the AI scribe. It ends by saying CPSBC does not endorse any specific AI scribes.

Three of the six general principles do most of the work for scribes. Under privacy, confidentiality and consent, personal patient data must not be transferred from the clinical environment without patient consent or legal authority, and when seeking consent licensees must explain the nature of the AI, its benefits, limitations and risks; the guideline directs licensees to the OIPC to understand PIPA's requirements. Under accuracy and reliability, responsibility for decisions rests with the licensee and AI output can be partially or completely wrong. Under monitoring and oversight, licensees must ensure oversight of tools their employees use, including updates and maintenance, which is a direct instruction to control vendor updates that change how data is handled.

The guideline is a professional guideline rather than a practice standard, which means it describes a recommended course of action and allows reasonable discretion. Do not read that as optional. In a complaint about a wrong note, the guideline is the yardstick the inquiry committee will use, and the sentence about liability for the scribe's errors removes any argument that the vendor is responsible. Ontario's CPSO takes the same line, as set out on our Ontario AI scribe rules page.

It matters because the two statutes give different answers on consent, privacy impact assessments, data residency and breach notification, and because the OIPC's scribe guidance covers only one of them.

PIPA governs organisations, which in health care means physicians running their own practices, most primary care clinics and other entities providing health services outside a public body. FIPPA governs public bodies, which includes the Ministry of Health, the health authorities, most hospitals and government funded and operated clinics. The OIPC's January 2026 guidance is explicit that it addresses PIPA only and that public bodies rely on a different legal analysis. It also says that if you are uncertain, for example because you operate under contract for a public body, you should check your contract or take legal advice before going further.

For a physician with privileges who also runs a community office, both apply, to different encounters. The hospital's scribe is the hospital's system under FIPPA; the office scribe is the physician's under PIPA. Using the office subscription on a ward encounter moves health authority information onto a system the health authority has not assessed, which is the scenario the BC Scribe programme's approved versions exist to avoid.

The OIPC document is 20 pages and its appendix checklist is the practical part. Its main expectations are these.

• Establish authority for every flow. Collection from patients and anyone else present under Part 4, use within the clinic under Part 5, disclosure to the vendor under Part 6. The clinic must also examine the vendor's own collection, use and disclosure, because under section 4(2) the clinic remains responsible for information under its control even when the vendor has custody.
• Pass the reasonable person test. Purposes must be ones a reasonable person would consider appropriate in the circumstances. Consent does not cure an inappropriate purpose, and an appropriate purpose does not remove the need for consent. Both are required.
• Get express consent. In the majority of clinical scenarios consent is required, and it must be express rather than implied; the OIPC says deemed consent and opt out consent under section 8 are not appropriate for scribes because a reasonable person would not know what a scribe is or how much it collects. Verbal or written both work; written documentation in the file is highly recommended. Companions whose voices are captured should consent too, and minors are assessed for capacity.
• Give specific notice. The notice under section 10(1) must state the specific purposes of both clinic and vendor; "healthcare" is not specific enough. Patients must be told they can withdraw consent at any time with no change to their care.
• Watch for function creep. A vendor update that changes how information is collected, used, disclosed or stored can take a compliant deployment out of compliance. The OIPC's recommended protection is a contract term requiring the vendor to obtain permission before updates that change data handling.
• Secure it and keep it short. Section 34 requires reasonable security arrangements; the OIPC expects audio to be deleted once a transcript is generated unless there is a clear clinical purpose, and derived de-identified data to be treated with caution because voice is hard to anonymise.
• Cross border storage. PIPA has no specific rule on disclosure outside Canada, but the clinic can only disclose outside Canada if satisfied section 34 will be met, and the OIPC says a vendor storing sensitive information in a jurisdiction with inadequate privacy law is unlikely to meet it. Best practice is a PIA with a cross border risk component.
• Do not take the vendor's word. The guidance says there is no accreditation programme in Canada that approves compliance claims, and that claims of PIPEDA or HIPAA compliance are not good enough because it is PIPA that applies. Our HIPAA and AI page explains why the American framework vendors quote does not transfer.

Put together, the OIPC is asking for the same artefacts the IPC in Ontario asks for: a PIA, a specific consent script, a vendor agreement with use limits, retention, breach reporting and update control, and a review process. The AI scribe checklist covers the procurement questions; swap the business associate agreement for a PIPA service agreement and it applies directly.

Doctors of BC is the professional association rather than the regulator, and its Doctors Technology Office has produced the most usable implementation material in the province.

The DTO's Practical Considerations for Using AI Scribes is an end to end roadmap: assess clinic needs with an AI Scribe Selection Matrix covering device and operating system, EMR compatibility, patient demographics and language, templates and accent recognition; research solutions against privacy and security requirements; consult peers and Practice Support Program mentors; run scenario based demos; use free trials for staff testing only rather than on patient encounters; obtain consent verbally or in writing using the DTO's consent form template; start small; and evaluate against measures such as after hours charting time and patient experience. It also publishes an AI Scribe Bias Testing Clinic Assessment Tool, which is the only ready made way we have seen for a clinic to check CPSBC's bias principle in practice. The DTO guidance itself does not list vendors and does not set data residency requirements; it points to CPSBC, the CMPA and the OIPC for those.

Doctors of BC's April 14, 2025 policy statement on AI in health care is advocacy rather than obligation. It asks for physicians in AI governance, pre-market evaluation and post-market monitoring, and sustainable funding. Its pilot with Canada Health Infoway and Amplify Care, from late 2024 to early 2025, produced the figures the province now quotes: over 30 physicians, more than 7,000 appointments, 2.7 hours per week saved for family physicians, 3.4 minutes per appointment, and 97 percent willing to recommend. The pilot used vendors from Infoway's Request for Pre-Qualification, which BC physicians helped evaluate, and led to Infoway licences for BC family physicians and community paediatricians from June 2025.

Doctors of BC does not publish its own vendor evaluations or an approved list. For a private clinic, the practical shortlist is the intersection of Infoway's nine pre-qualified vendors and the six BC Scribe tools, checked against the OIPC's questions. That intersection, with what each vendor publishes on Canadian hosting and pricing, is on our best AI scribe in Canada guide.

The BC Scribe Trial was led through PHSA with partner health authorities across several EMR platforms and clinical settings. Six tools were approved for the trial and carried into the self pay phase: Heidi (Heidi Health), Autochart.ai (Aya Health Technologies), Empathia AI, Tali (Tali AI), AutoScribe Express (Mutuo Health Solutions) and Scribeberry. From December 4, 2025 to December 4, 2026 the BC Scribe Self Pay Program lets physicians, nurse practitioners, midwives and dentists in ambulatory settings at Fraser Health, Vancouver Coastal Health, PHSA, Providence Health Care, Northern Health, Interior Health and Island Health buy discounted subscriptions on the health authority approved version of each tool. Not every vendor is available in every health authority, prices are set by vendors and subject to change, and the discount applies only to the approved version. Northern Health's medical staff page notes that its sign up for Heidi closed on June 16, 2026 while the others remained open, and that the programme is scheduled to conclude on December 4, 2026, after which vendor pricing and features may change.

Two details show what "approved version" means. Mutuo's AutoScribe Express is described as storing data for only two days, against up to 30 days on the standard product. And each health authority must complete its own privacy impact assessment and security threat and risk assessment under FIPPA before staff use a tool, which is why availability differs by region. Participating vendors were offered negotiated health authority contracts with standardised requirements for privacy, security, data handling and clinical governance.

FIPPA is the reason the public system moves this way. Section 69 requires a privacy impact assessment for a new system; section 30 requires reasonable security; section 36.3 requires breach notification where there is a real risk of significant harm; and section 33.1, since Bill 22 replaced the old section 30.1 in November 2021, permits disclosure outside Canada only in accordance with regulations. Bill 22 removed BC's blanket in Canada storage rule, which had been the strictest in the country, but health authorities have continued to require Canadian hosting in their assessments and all six BC Scribe vendors state Canadian data residency.

If you are medical staff, the decision is which of the approved tools fits your specialty and EMR, and the health authority has done the privacy work. If you also run a private office, the BC Scribe subscription does not carry that assessment with it: the office use is a PIPA question that you answer yourself.

The same skeleton as the CPSO aligned outline on our Ontario page, with six BC specific clauses.

1. Statute and status. State whether the clinic is an organisation under PIPA or acts for a public body under FIPPA, and for physicians with privileges, which scribe is used where.
2. Express consent script. The DTO template or your own, covering what the scribe records, that a named vendor processes it, where it is stored, when it is deleted, that the physician reviews the note, that companions are recorded, and that the patient can decline or withdraw at any time without any change to care. Record the answer.
3. Audio handling. Whether the tool stores audio; if it does, compliance with the Photographic, Video and Audio Recording of Patients standard; deletion on transcription unless there is a documented clinical reason.
4. Review before entry. No note enters the record unread; the signing licensee checks names, laterality, medications, dates and anything the model could not have heard. The CPSBC sentence on liability for scribe errors belongs in the policy verbatim.
5. Vendor agreement and update control. A written agreement with use restrictions, retention and destruction, subprocessors, breach reporting to the clinic, and the OIPC's recommended term requiring permission before updates that change data handling. A PIA with a cross border component if any data leaves Canada.
6. Bias check and review cycle. Use of the DTO bias testing tool on your own patient population, an annual policy review and a named owner.

The general purpose sections, on approved and prohibited tools, what staff may paste into anything, and incident reporting, are in our AI policy template for medical practices. Writing and training on the policy is what our AI governance and compliance engagement produces.

Ask the OIPC's questions, in writing, and keep the answers with the PIA. The ones that separate vendors in BC are: where is data stored and processed, and is any of it sent outside Canada; will you store voice recordings or delete them on transcription, and is retention adjustable; do you use any information, including de-identified information, for training or product development; which subprocessors handle our data; will you notify us of any breach on your side, and how quickly; will you seek our permission before updates that change how information is handled; and which version of your product is the one the BC health authorities approved, and how does it differ from the retail one.

On price, the BC Scribe programme discounts are vendor set and not published centrally. Retail Canadian pricing published by the six vendors in September 2026 ranged from free tiers to around 100 to 150 dollars per clinician per month, with several publishing in Canadian dollars; details are on the scribe pricing comparison and the Canadian guide. Against the Doctors of BC pilot figure of 2.7 hours a week, the AI scribe ROI calculator will show the break even for your visit volume, and the workflow itself is described on the ambient scribe page.

BC has done more structured evaluation than any other province: a Doctors of BC pilot, an Infoway pre-qualification with BC physicians on the panel, and a PHSA led randomised multi vendor trial. What a private clinic still lacks is the output of that work in a form it can rely on. The trial results were not fully public in September 2026, health authority PIAs are not shared with community clinics, and the OIPC has said in terms that nobody accredits a vendor's compliance claim.

An independent advisor closes that gap. We compare the shortlist against the OIPC's checklist rather than the vendor's deck, write the PIA and the service agreement schedule, set up a pilot that measures note accuracy and after hours time rather than assuming them, and produce the policy and training the College expects. We take no vendor commissions, which in a market of six approved tools and thirty aspirants is the only way to be useful.

That is what our vendor selection engagement does, with AI governance and compliance for the assessment and policy layer. To talk through where your clinic or department is, book a call.