What is AI?

Artificial intelligence (AI) is an advanced form of information processing that helps automate or enhance tasks. In healthcare, AI doesn’t replace providers—it supports them. Clinicians still guide its use, review outputs, and make informed decisions.

AI can reduce administrative burden and help address physician burnout. Importantly, it should not be used to increase patient volumes. Instead, it is a tool to enhance care and support the physician’s role.

AI tools typically combine hardware, software, and data. Even familiar tools like Microsoft Copilot or ChatGPT follow this model. In healthcare, software is often applied to patient data, which means privacy and transparency are critical.

What Is an AI Scribe?

“AI Scribe” is a broad term for tools that help generate clinical notes. Common workflows include:

• Dictation: provider speaks, and AI formats the note.
• Live Listening (also called Ambient Listening): AI listens during a patient visit and drafts the note based on the conversation.
• Advanced features: some tools analyze lab trends, suggest diagnoses, or remind providers about follow-ups.

See my article Thinking About Using AI Scribe in Your Healthcare Practice? for additional background.

Why AI Governance Matters

Each clinic must manage how personal health information (PHI) is collected, used, accessed, and disclosed—especially when introducing new technology.

An AI governance framework provides a structured approach to address risks, ethics, and compliance. Think back to when computers first arrived in clinics: there was hype, confusion, and risk. Eventually, we built vendor vetting processes, training, and structured implementation. The same is true today with AI.

Key principles:

• Create written procedures for evaluating vendors.
• Set clear expectations: employees should not independently adopt AI tools.
• Encourage open discussion and collaborative decision-making.

AI Governance and Accountability Framework

Just as it was never appropriate for individuals to bring their own computers from home to manage patient records, it is not appropriate for clinicians or staff to adopt AI tools on their own.

Introducing AI into a clinic requires a collaborative, structured approach. An AI governance framework helps organizations manage risks, ethics, and compliance requirements, including new or emerging risks.

Every clinic should have written procedures that:

• Set clear expectations for evaluating and selecting vendors.
• Prohibit staff from independently implementing AI tools.
• Encourage open discussion and a culture of accountability when considering new technologies.

Without this oversight, indiscriminate use of AI can compromise the accuracy, integrity, and security of personal health information (PHI) — and create risks for the entire organization.

Implementation: Not Plug and Play

AI adoption requires planning. Assign responsibility and accountability for implementation and monitoring. Include your privacy officer in this role.

Your plan should include:

• Staff training and awareness
• Confidentiality and end-user agreements
• Cybersecurity and technical safeguards

Do You Need a Privacy Impact Assessment (PIA)?

Yes! If an AI system introduces new collections, uses, or disclosures of PHI, a PIA is required.

Custodians must ensure PHI is protected against theft, loss, and unauthorized use or disclosure, and that records are securely retained, transferred, and disposed of. This includes ensuring vendors have sufficient safeguards in place.

Recent Resources

Here are a few current references to support your decision-making:

• • Canada Health Infoway – AI Scribe licensing program for eligible primary care providers (May 2025).
  • Alberta OIPC – AI Scribe Privacy Impact Assessment Guidance (Sept 22, 2025).
  • Canada Health Infoway announcement – Supports AI Scribe Implementation in Alberta.
  • OntarioMD – Contractual Safeguards Guidance.
  • Supply Ontario – Vendor of Record list.
  • Alberta Medical Association – AI Principles and Policy (Feb 7, 2025).

Canada Health Infoway announced in May 2025 a program offering one-year fully funded one-year licenses for eligible primary care providers across Canada. Visit Canada Health Infoway to register for updates and eligibility notifications.

Artificial Intelligence (AI) Scribe Privacy Impact Assessment Guidance developed by the Office of the Information and Privacy Commissioner (OIPC) of Alberta.  September 22, 22025.

Canada Health Infoway Supports AI Scribe Implementation in Alberta with Reference to OIPC Privacy Guidance – September 22, 2025

Contractual Safeguards – Ontario MD Guidance – AI Scribes

Vendor of Record list, Supply Ontario – This list features qualified solutions that meet the needs of clinicians

AMA Artificial Intelligence Principles and Policy, February 7, 2025

Need help getting started with your AI privacy and implementation plan?

• • • Explore our blog posts on AI and privacy.
    • Join the Practice Management Success membership for training, templates, and discussions.
    • Or ask me directly about PIA consultation services to support your clinic’s AI implementation.

 

 

When we know better, we can do better…

Jean Eaton is constructively obsessive about privacy, confidentiality, and security especially when it comes to the handling of personal health information. If you would like to discuss how I can help your practice, just send me an email. I am here to help you.

Jean L. Eaton
Your Practical Privacy Coach
INFORMATION MANAGERS