Ontario AI Scribe Rules: CPSO Advice, PHIPA and the IPC Guidance in One Place

Four things, and they are short enough to memorise.

CPSO's Advice to the Profession: Using Artificial Intelligence in Clinical Practice, last updated August 2025, states that physicians must review all information generated using AI for accuracy and completeness, that they are ultimately accountable for their use of AI tools including for medical documentation through AI scribes, that patient data entered into AI applications must be kept private and secure with no change to the physician's obligations under PHIPA, and that physicians must inform patients about how AI will be used and in particular obtain patient consent before recording conversations using AI. It also asks physicians to consider whether the tool is appropriate for their patient population and to evaluate output for bias.

The earlier June 2024 advice, which the current document replaced, was more specific about the consent script. It suggested asking the patient to consent to having the AI scribe "listen and summarize the conversation" for the purpose of medical documentation, and it tied the privacy expectation to three existing policies: Medical Records Management, Medical Records Documentation and Protecting Personal Health Information. Those policies still apply. A scribe does not create a new records standard; it has to meet the existing one.

Two further points from the CPSO text matter in practice. First, CPSO says it cannot recommend specific AI technology and instead points to the Ontario AI Scribe Program's Vendor of Record list and to Canada Health Infoway's list. That means buying from either list is evidence of reasonable diligence, but it is not a defence if the note is wrong. Second, the advice says there is not currently a specific law or policy addressing AI, and that the core expectations of physicians remain unchanged. The College will judge a scribe complaint against the medical records and privacy policies it already has, and those policies are what the outline later on this page is built around.

None of this is unique to Ontario. The same review and consent expectations appear in the British Columbia, Alberta and Quebec guidance, with different privacy statutes underneath.

PHIPA applies through the custodian and agent structure, and it is worth being precise because the vendor contract depends on it.

The physician, group or hospital is the health information custodian under section 3. The scribe vendor, when it receives audio, transcripts or draft notes on the custodian's behalf, is an agent under section 17: it may collect, use, disclose, retain or dispose of personal health information only as the custodian permits, only for the custodian's purposes, and not for its own. A vendor that wants to use recordings to improve its model is asking to step outside the agent relationship, and the custodian would need a separate lawful basis, which in practice means express consent from every patient or de-identification that meets the IPC's standard. The Vendor of Record contract simply prohibits it.

Section 12 requires the custodian to take reasonable steps to protect the information against theft, loss and unauthorised use or disclosure, and to notify the individual at the first reasonable opportunity if it is stolen, lost or used or disclosed without authority. Since 2017 the custodian must also report prescribed categories of breach to the IPC and include breach statistics in an annual report. A vendor incident is the custodian's breach.

On data residency: PHIPA does not contain a general prohibition on storing personal health information outside Canada. What it does is make the custodian responsible for the information wherever it sits, which is why the IPC's guidance asks custodians to scrutinise cross border storage and why Supply Ontario made in Canada storage and processing a condition of the Vendor of Record list. A clinic buying outside the list may lawfully choose a vendor hosted in the United States, but it then has to justify that in its privacy impact assessment, address the exposure to foreign legal process, and explain it to patients in the consent conversation. Most Ontario clinics conclude that the justification is not worth writing. This is also where the vendor's HIPAA language belongs: as we explain on the HIPAA and AI compliance page, HIPAA is a United States statute that does not apply in Ontario, and a business associate agreement is not a PHIPA agent agreement.

The 2024 to 2025 amendments do not change any of this. Administrative monetary penalties (January 1, 2024) raise the cost of getting it wrong. The More Convenient Care Act, 2025 adds Part V.2 on digital health identifiers, run by Ontario Health as the prescribed organisation. Bill 194's Enhancing Digital Security and Trust Act, in force from July 1, 2025, adds cyber security, AI and privacy impact assessment duties for hospitals and agencies under FIPPA, which for a hospital scribe programme means the FIPPA privacy officer and the PHIPA privacy officer are the same problem.

The IPC document is the closest thing Ontario has to a specification, and a clinic that can tick its checklist has done most of the work a complaint or breach investigation would ask about.

• Governance first. A governance and accountability framework proportionate to the organisation, which for a hospital means an AI oversight committee and for a small clinic means a named owner, a written policy and a review date.
• Assess before you buy. A privacy impact assessment before introducing a scribe, updated when the purpose, system or risk changes, and an algorithmic or AI impact assessment where the tool goes beyond transcription into suggestions.
• Consent. The IPC's position is that consent of individuals would generally be required, that patients must understand they are being recorded by AI, what is collected, that a vendor is involved and what the risks and benefits are, and that a patient who declines must receive the same level of care.
• Minimise and delete. Collect only what the note needs, and delete recordings and transcripts once the validated summary is in the electronic medical record. The guidance is direct that full audio rarely needs to be kept.
• No secondary use. Vendor use of patient information for product development or model training requires valid consent or de-identification to a very low re-identification risk, and the IPC notes that audio almost never meets that bar.
• Human in the loop. Adequately trained people review every AI generated note before it enters the record, with procedures for spotting inaccuracies and bias.
• Contract terms. Limits on the vendor's access and use, retention and destruction obligations, subcontractor controls, security commitments, PHIPA specific breach notification and audit rights, plus ongoing performance monitoring.

The IPC also released a one page checklist alongside the guidance. It is the document to attach to your privacy impact assessment as the evidence that you applied the regulator's own test. Where a clinic lacks the time to run the assessment itself, that is the first deliverable of our AI governance and compliance engagement.

The Ontario AI Scribe Program was established by the Ministry of Health and Ontario Health, with Supply Ontario running the procurement and OntarioMD supporting clinicians. Supply Ontario's Tender 20123 created a Vendor of Record arrangement for AI scribes with a term from April 27, 2025 to April 27, 2028 and an optional one year extension. The list was published on June 3, 2025 with 20 vendors and had grown to 30 by September 2026, including Heidi Health, Tali AI, Scribeberry, Empathia AI, Mutuo Health Solutions (AutoScribe), Pippen AI, Mikata Health, Aya Health Technologies (Autochart.ai), MEDFAR (CareWay) and Solventum Canada (Fluency Align), as listed on Supply Ontario's site in September 2026.

The list's value is in its conditions. Vendors on it must store and process personal health information in Canada, comply with PHIPA, submit to independent third party threat assessments, and are prohibited from using patient data for any purpose beyond providing the scribe service. Supply Ontario negotiated a minimum discount with each vendor, licensed health practitioners, medical professional corporations and unincorporated groups can all buy from it, and most vendors offer a 30 day trial that can be extended to 60. There is no provincial subsidy: OntarioMD's FAQ says any future financial incentive is at the Ministry's discretion.

Canada Health Infoway's national AI Scribe Program, launched June 2025, is a different list. Nine vendors were pre-qualified nationally: Autochart.AI, AutoScribe, CareWay, Empathia AI, Mika AI, NexusAI (WELL Health), Pippen, Scribeberry and Tali. It funded up to 10,000 one year licences for primary care clinicians who signed with a vendor by December 31, 2025, and Infoway's evaluation reported that nearly 70 percent of participants felt less administrative burden and over 90 percent agreed the scribe added value. Those licences expire through 2026, which is why many Ontario clinics are now choosing what to pay for.

Should you buy from the Vendor of Record list? Usually yes, because the contract terms are better than most small clinics can negotiate and the residency and no training conditions are already in writing. But read the Auditor General's May 2026 findings before you treat the list as a quality mark: every approved vendor produced inaccuracies in procurement testing, and the audit found limited validation of vendor claims. The list narrows the field. It does not pick the product, and it does not write your privacy impact assessment. The national picture, including which vendors publish Canadian hosting and CAD pricing, is on our best AI scribe in Canada guide, and the general market is on the AI medical scribes comparison.

Express, informed, documented, and repeatable. That is the combined effect of CPSO's advice, PHIPA's knowledgeable consent standard in section 18 and the IPC's guidance.

PHIPA permits implied consent for collection, use and disclosure within the circle of care for the purpose of providing health care. Recording a consultation and sending the audio to a third party company is not obviously within what a patient would expect from a visit, and CPSO removes the ambiguity by requiring consent before any recording. Do not rely on a poster in the waiting room. Ask, once, in plain language, and record the answer in the chart. OntarioMD publishes a patient consent toolkit that CPSO's advice links to, and it is a reasonable starting script.

The consent conversation has to cover the things the IPC says patients must understand: that an AI tool will record and summarise the visit, that a named vendor processes the recording, where the data is stored, that the recording is deleted after the note is finalised, that the physician reviews and signs the note, and that the patient can say no now or later without any change to their care. If a family member or interpreter is in the room, their voice is being recorded too.

Frequency is a judgement call in Ontario, unlike Quebec, where the CMQ has set out when consent must be renewed. A defensible practice is to obtain express consent at first use, record it, and remind the patient at subsequent visits with an opportunity to decline, with fresh consent when the tool changes materially or when the visit concerns something the patient may consider especially sensitive. Configure the scribe so that a declined visit is a normal visit, with no penalty in scheduling and no pressure from staff.

Finally, retention. The IPC expects recordings and transcripts to be deleted once the validated note is in the record. Check the vendor's default retention setting and change it if the default is longer than you need; some products keep audio for 30 days unless told otherwise. What stays is the signed note, which is part of the medical record and subject to the ordinary retention rules in CPSO's Medical Records Management policy.

This is the outline we use when an Ontario clinic asks for an AI policy template. It maps each clause to the CPSO expectation or PHIPA duty it satisfies so that a reviewer can see the logic. Adapt the wording with your own counsel; the structure is the point.

Two notes on using it. The appendix in clause 3 is the part that will change; keep it as a separate page so it can be updated without reissuing the policy. And the outline deliberately does not restate the statute. A policy that quotes PHIPA at length is a policy nobody reads. For the general purpose version of clauses 1, 3, 6 and 9, which covers chatbots and drafting tools as well as scribes, see our AI policy template for medical practices; for the procurement side, the AI scribe checklist translates directly once you swap the business associate agreement for a PHIPA agent agreement.

Ten questions, all of which have a right answer under the rules above.

1. Where is audio, transcript and note data stored and processed, by province and cloud region, and will you put that in the contract?
2. Are you on the Supply Ontario Vendor of Record list, and if so which product version is covered by it? Vendors sometimes list a specific edition.
3. Will you sign an agreement in which you act as our agent under PHIPA section 17, with the use limits, retention, subcontractor, breach notification and audit terms the IPC lists?
4. Do you use any patient data, including de-identified data, to train or improve models? What does "de-identified" mean in your process?
5. What is the default retention for audio and transcripts, can we set it to delete on signature, and can you evidence deletion?
6. Which subprocessors handle our data, including the speech and language model providers, and where are they?
7. What independent security assessment do you hold, and will you share the report rather than the certificate?
8. How does the product perform for our patient population, including accents and languages, and what testing supports that claim?
9. How does the note reach our EMR: integration, browser extension or copy and paste, and what does each mean for where data passes through? Ontario EMR integrations differ from the United States market covered on our ambient scribe page.
10. What happens to our data and our notes at termination, and what is the notice period?

Price is the eleventh question, not the first. Published Ontario prices range from free tiers to roughly 100 to 150 dollars per clinician per month, and the AI scribe ROI calculator will tell you whether the OntarioMD figure of three to four hours a week covers it at your visit volume. Our scribe pricing comparison lists what vendors publish.

The Vendor of Record list, the CPSO advice and the IPC checklist together give an Ontario clinic more structure than almost any other jurisdiction offers. What they do not give you is a decision. Thirty vendors on one list and nine on another, an Auditor General's finding that every one of them made errors in testing, and a privacy impact assessment that nobody else can write for you: that is the actual state of play in September 2026.

An independent advisor with no vendor commissions does three things a clinic finds hard to do alone. It runs a structured comparison across the vendors that fit your EMR and specialty, against the IPC's questions rather than the vendor's demo. It writes the privacy impact assessment, the agent agreement schedule and the policy above so that the paperwork exists before the first recording. And it sets up the pilot so that note accuracy is measured rather than assumed, which is the gap the Auditor General identified.

That is what our vendor selection engagement does for scribes, and what AI governance and compliance does for the policy and assessment layer. If you would rather start with a conversation about where your clinic is, book a call.