Your Locum Has an AI Scribe. Is It Approved for Use in Your Clinic?

Prevent Shadow AI: Make Sure Locums Follow Your Clinic’s Privacy Policies and Procedures

You’ve arranged for a locum healthcare provider to cover your practice. Great! You’ve organized the schedule, prepared EMR access, and made sure everything is ready.

But have you asked one important question?

“Are you planning to use an AI tool while working in our clinic?”

Your locum may already be using an AI scribe. They may love it! It saves time, reduces documentation workload, and helps them focus on patient care.

But just because the locum is familiar with an AI tool doesn’t mean that it has been approved for use in your clinic.

And that’s where privacy risks can begin.

What Is Shadow AI?

Shadow AI happens when employees, contractors, or healthcare providers use artificial intelligence tools for work without the organization’s knowledge or approval.

Imagine a locum who arrives at your clinic with their favourite AI scribe already installed on their mobile phone.

They begin recording patient encounters and generating clinical notes, assuming it’s acceptable because they’ve used the application elsewhere.

But your clinic hasn’t reviewed the AI vendor, completed the necessary privacy assessment, or confirmed where the patient information is stored and processed.

You haven’t provided patients with the appropriate notice about AI use or obtained their acknowledgement.

Perhaps the audio recordings remain on the locum’s personal device. Perhaps the vendor retains information longer than your clinic permits.

Now you have a potential privacy breach—and a problem that could have been prevented with better preparation.

Custodians: Your Clinic’s Rules Still Apply

Locums are valuable members of your healthcare team. They bring experience, flexibility, and much-needed coverage.

But they also need to understand and follow your clinic’s privacy and security policies and procedures.

As a custodian responsible for health information, you need to establish clear expectations about how patient information is collected, used, disclosed, stored, and protected.

That includes the use of AI tools.

You don’t have to prohibit AI. You do need a process to determine which AI applications are appropriate for your clinic and how they may be used.

If a locum wants to use an AI tool that your clinic hasn’t approved, there should be a process to request a review before the tool is used with patient information.

Prepare an AI Onboarding Package for Locums

One of the easiest ways to prevent shadow AI is to prepare an AI onboarding package that you can share with every locum before they begin working in your practice.

Your package should include:

1. Your AI Governance Framework

Explain your clinic’s rules for adopting and using AI tools. Identify who approves new AI applications, what assessments are required, and the responsibilities of healthcare providers.

2. Your List of Approved AI Tools

Identify approved applications and explain that personal AI accounts and unapproved tools must not be used with patient information.

3. Oath of Confidentiality

Ensure the locum acknowledges your clinic’s confidentiality, privacy, and security requirements. Professional experience doesn’t replace the need to follow your organization’s policies.

4. AI User Training and Acknowledgement

Don’t assume that because someone knows how to use an AI application, they know how to use it safely in your clinic.

Provide practical instructions about patient notices and consent where applicable, audio recording and deletion, transferring AI-generated notes into the EMR, and reviewing AI-generated content.

5. Monitoring and Follow-Up

Your responsibility doesn’t end when the locum signs the acknowledgement.

Confirm that approved tools are being used appropriately. Address questions, reinforce expectations, and document your follow-up.

Remember: AI Doesn’t Replace Professional Judgment

An AI scribe may generate a draft clinical note, but the healthcare provider remains responsible for reviewing the documentation for accuracy, completeness, and appropriateness before it becomes part of the patient record.

AI-generated documentation can contain errors, omissions.

Your AI policies and training should make that responsibility clear.

Don’t Wait Until the Locum Arrives

Imagine how much easier this conversation will be if you have already prepared your AI onboarding package.

Before the locum’s first day, you can explain:

“Here are the AI tools we’ve approved for use in our clinic. Here’s how we use them safely. If you would like to use a different application, please talk to us first.”

That’s a much better conversation than discovering an unapproved AI tool after patient information has already been shared.

Your goal isn’t to make life difficult for locums. It’s to help them provide excellent patient care while protecting the privacy and security of your patients’ information.

Your Next Step: Download the AI Governance Framework

Do you have an AI Governance Framework for your healthcare practice?

If not, now is a good time to get started.

An AI Governance Framework helps your clinic establish clear expectations for approving, implementing, and monitoring AI tools—including those used by locums, contractors, and employees.

Download the AI Governance Framework Template to help you develop practical rules for responsible AI use in your healthcare practice.

Get Your AI Governance Framework Template​

​You Might Also Be Interested in These Articles…

AI Scribes in Canada
Learn about AI scribe initiatives in Canada, AI governance, privacy impact assessments, and the importance of approving AI tools before introducing them into your healthcare practice.

Thinking About Using AI Scribe in Your Healthcare Practice?
Explore the benefits and privacy considerations of AI scribes, including patient notification, vendor selection, and responsible implementation.

Privacy Officer Check-Up: 10 Things You Should Review

When was the last time you checked whether your privacy management program still reflects how your healthcare practice actually operates?

Employees change. Technology changes. Vendors change. New AI tools appear. Meanwhile, policies, procedures and Privacy Impact Assessments can quickly become outdated.

A Privacy Officer Check-Up helps you recognize what you have accomplished, identify what has changed and prioritize what needs attention next.

You do not need to fix everything today. The goal is to know where you are—and what comes next.

1. Confirm Your Privacy Officer Information Is Current

Check that the correct Privacy Officer information appears in your policies, collection notices, patient information, website, Privacy Impact Assessments and information provided to your privacy regulator, where applicable.

Identify the Privacy Officer including a telephone number or email address patients can use.

Most importantly, make sure everyone on your team knows who the Privacy Officer is and how to contact them.

2. Review Privacy Awareness Training

Privacy training should be included in onboarding, regular annual refresher training and updates following changes to legislation, technology, policies or privacy risks.

Registering someone for training is not the same as confirming they completed it. Your records should demonstrate who completed the training and when.

3. Review Oaths of Confidentiality Agreements

Confirm that custodians and affiliates—including employees, contractors, students and volunteers—have signed current and appropriate Oaths of Confidentiality.

Check that the agreements are signed, current, appropriate to each person’s responsibilities and accessible in the applicable personnel or contractor record.

4. Review User Accounts and Access Permissions

Ask your system administrators or IT provider to generate current user-account reports for your:

• EMR, pharmacy management or clinical systems
• Email and business computer systems
• Microsoft 365 or Google Workspace
• Shared folders and cloud applications
• Remote-access tools
• Administrative accounts

Remove or disable accounts that are no longer required. Confirm that current users have access appropriate to their roles. Document that the review was completed.

5. Check Whether Your PIAs Are Current

Compare your current operations with your existing Privacy Impact Assessments.

Have you changed software, vendors, locations, patient communication tools, information flows, business structure or Privacy Officer? Have you changed how health information is collected, used, disclosed, stored or destroyed?

Determine whether a PIA amendment, update or new PIA may be required.

6. Identify New Software, Vendors and Technology

Make a list of technology introduced since your last privacy review. This might include online booking, patient portals, electronic forms, payment systems, cloud storage, messaging tools, virtual care, transcription services or AI.

Privacy Officers should know which technologies handle health information and what safeguards are in place.

Review your Information Management Agreement listing and confirm that you have appropriate agreements with your service providers.

7. Find Out How Staff Are Using AI

Do not assume you know how AI is being used in your practice. Ask.

Staff and healthcare providers may be using AI for clinical documentation, meeting notes, drafting emails, summarizing documents, patient education, administration or marketing.

Confirm that identifying health information is not being entered into unapproved AI tools. Review whether your organization needs an AI Governance Framework, approved-tool list, vendor assessment, training or PIA.

8. Review Your Privacy Breach and Incident Log

Review the privacy incidents, near misses, complaints and concerns recorded by your organization.

Look for recurring problems, incomplete corrective actions, additional training needs and outstanding notifications.

For example, if faxes continue to be sent to the wrong recipients, reminding employees to “be more careful” may not be an effective corrective action. A recurring problem may indicate that the process or technology needs to change.

If you do not have a privacy breach log, now is a good time to start one.

9. Review and Test Your Privacy Breach Response

Review the Privacy Breach Management procedure in your Health Information Privacy and Security Policies and Procedures Manual.

Confirm that staff know how to recognize a possible breach, who to notify, what immediate containment steps to take and what information to document.

Test the procedure using a short, realistic scenario. A five-minute tabletop exercise can help your team understand what to do before a real incident occurs.

Document the exercise, who participated and any follow-up actions identified.

10. Document Your Review and Follow-Up Actions

For each checklist item:

• Record what you reviewed
• Identify any gaps
• Assign responsibility
• Establish a realistic follow-up date
• Document when the action is completed

Keep the completed checklist as evidence of your ongoing privacy management program and demonstrable accountability.

Practical Privacy Tip

Do not try to fix everything during the check-up.

First, identify what is working, what has changed and what needs attention. Then prioritize your actions, assign responsibility and set realistic follow-up dates.

One completed action followed by another is more effective than an overwhelming list that never gets started.

Download the Privacy Officer Check-Up

Would you like a practical way to complete this review?

Download the Privacy Officer Check-Up: 10 Things You Should Review checklist.

Use it to recognize your accomplishments, identify gaps, assign responsibility and plan your next privacy management activities.

Get the checklist here:

Wish You Had a “Jeanie” to Help With Your Privacy Officer Role?

You don’t have to figure everything out on your own.

Practical Privacy Officer Strategies gives you practical training, tools, templates, and live coaching to help you know what to do next—and how to get it done.

Learn More About Practical Privacy Officer Strategies