AI scribes listen to a care visit and draft the clinical note. Clinics, physiotherapy practices and diagnostic operators across Ontario are adopting them to cut charting time.

On January 28, 2026, Ontario’s Information and Privacy Commissioner (IPC) published AI Scribes: Key Considerations for the Health Sector and a companion checklist. The guidance runs to more than 30 pages. This guide turns it into 6 things a well-governed scribe rollout has in place, with the rule, case or guidance behind each.

Key takeaways

• One named person owns the scribe, and staff use only approved tools. An unapproved transcription app put 7 patients’ health information in front of the wrong people at an Ontario hospital in 2024.

• Patients are asked before the scribe starts, and anyone who declines gets the same care with notes written another way.

• The vendor contract says whether recordings can train the vendor’s model, how long audio is kept, and where it is stored.

• A clinician reviews every AI-drafted note before it is used or shared. The clinician answers for the record.

• If you treat US patients or sell into the US, California, Texas and Louisiana each add their own patient disclosure rules.

• Accuracy is sampled on a schedule, vendor updates are tested before release, and someone can pause the scribe.

Example record for a fictional 6-site Ontario physiotherapy and diagnostic operator. Names and dates are illustrative.

The 6 elements

Each element maps to a dimension in Meninge’s 10-dimension governance scorecard, so you can see which part of your program it tests.

1. A named owner and an approved-tool list

Scorecard: Dim 1, AI Inventory & System Transparency; Dim 6, Human Oversight & Accountability

One person, by name and title, decides whether the scribe is used, watches how it performs, and can pause it. Write down which scribe staff may use, and say plainly that personal apps are off limits for patient work.

The IPC guidance asks for an AI governance committee or, for smaller custodians, a designated person with that accountability, including the call to pause (section 3.1). It also asks custodians to state whether staff may use AI tools they bought themselves (section 3.5). The reason is Reported Breach HR24-00691: on September 23, 2024, a physician who had left an Ontario hospital in June 2023 installed Otter.ai on a personal device. The app joined a virtual rounds meeting through an invite still sitting in his personal calendar and transcribed discussion of 7 patients. The IPC’s October 27, 2025 letter recommended offboarding audits that revoke calendar access, plus meeting lobbies so no unapproved bot can join.

Sources: IPC, AI Scribes: Key Considerations for the Health Sector, IPC letter, Reported Breach HR24-00691, IPC Case of Note

2. Patient consent, with a way to say no

Scorecard: Dim 8, Regulatory Compliance & Legal Readiness

Ask before the scribe starts. Tell the patient what it records, who the vendor is, and that saying no changes nothing about their care. Note the answer in the chart, and have a non-AI way to document the visit ready.

The IPC says no PHIPA provision explicitly allows a scribe to collect health information without consent, so consent would generally be required. It calls express consent recorded in the chart a best practice, and says patients who decline must receive the same or similar care (section 6.2). The College of Physiotherapists of Ontario asks registrants to obtain informed consent and be ready to take notes without AI. The IPC also flags open-concept physiotherapy and chiropractic spaces, where a microphone can pick up other patients’ conversations (section 6.3).

Sources: IPC, AI Scribes: Key Considerations for the Health Sector, College of Physiotherapists of Ontario, AI scribes guide

3. Vendor terms on training, retention and location

Scorecard: Dim 9, Vendor & Third-Party AI Management

Before signing, get answers in writing: can the vendor use your recordings or transcripts to train its model, how long is audio kept and who deletes it, where is data stored, and which subcontractors touch it. Decide whether you need to keep audio and transcripts at all once a note is signed. The Perfectly Governed AI Vendor Contract covers the rest of the contract.

The IPC says the contract should bar the vendor from using health information for any purpose you have not authorized, require secure disposal on request, cover subcontractors, and require the vendor to tell you when accuracy drops below agreed thresholds (section 5.3). Sharing recordings for model training needs patient consent or effective de-identification, and the IPC warns that voice recordings may be close to impossible to de-identify (sections 5.4 and 6.3). PHIPA allows storage outside Ontario or Canada, with the custodian still accountable (section 4.6). The same duties apply during a free trial.

Source: IPC, AI Scribes: Key Considerations for the Health Sector

4. Clinician review before the note is used

Scorecard: Dim 6, Human Oversight & Accountability

The clinician reads and corrects every AI-drafted note before it is saved, used or shared. If the scribe can write to the EMR first, unreviewed content is flagged and blocked from disclosure. Mark which parts of the record came from the scribe.

The IPC asks custodians to make sure every record a scribe creates or changes is reviewed for accuracy before any use or disclosure, and says review before EMR entry is best practice (section 6.1). The College of Physiotherapists of Ontario says the physiotherapist is responsible for the accuracy of AI outputs, and gives an example: a general-purpose scribe may miss physiotherapy terms such as kinesio taping or plinth. An OntarioMD pilot cited by the IPC found weaker performance on multilingual conversations.

Sources: IPC, AI Scribes: Key Considerations for the Health Sector, College of Physiotherapists of Ontario, AI scribes guide

5. Disclosure rules where your patients are

Scorecard: Dim 8, Regulatory Compliance & Legal Readiness

If you treat US patients, or sell a scribe or health app to US providers, check each state where care happens. Three states now have patient-facing AI rules that can touch a scribe workflow.

California AB 3030 (in force January 1, 2025) requires a disclaimer and instructions for reaching a human on generative AI patient communications about clinical information, unless a licensed provider reads and reviews the message first. A scribe-drafted visit summary sent to a patient is the case to check. Texas TRAIGA (in force January 1, 2026, Bus. & Com. Code § 552.051) requires health care providers to disclose AI used in relation to a service or treatment, in plain language, no later than the date it is first provided. Louisiana Act 649 (in force August 1, 2026) requires a verbal disclosure before any part of an appointment is recorded for AI transcription.

Sources: Morgan Lewis on California AB 3030, Phelps Dunbar on Texas and Louisiana, Louisiana Act 649

6. Monitoring, logs and a tested pause

Scorecard: Dim 7, Incident Response & Monitoring

Sample notes for accuracy on a schedule, and again when errors spike. Test vendor updates and new features before they reach clinicians. Keep logs that show which parts of a record the scribe wrote and who approved them. Name who can pause the scribe, and test the pause.

The IPC asks for monitoring that is both scheduled and triggered by unexpected behaviour, vetting of vendor changes before production, attention to vendor acquisitions that change terms, and clear thresholds for turning a scribe off (section 6.8). It notes custodians may need audit logs showing what the scribe generated and when, and by whom, it was approved (section 6.7). In the US, the Joint Commission and the Coalition for Health AI listed ongoing quality monitoring among 7 elements of responsible AI use on September 17, 2025. That guidance is voluntary.

Sources: IPC, AI Scribes: Key Considerations for the Health Sector, Becker’s on the Joint Commission and CHAI guidance

Check your own scribe rollout

Ask for each item below. Time how long each one takes to produce. That number is a finding on its own.

• Owner and tools: a name and title, plus the approved-tool list staff signed (IPC ss. 3.1, 3.5; HR24-00691)

• Consent: the consent script, one chart entry, and the decline workflow (IPC s. 6.2; College of Physiotherapists of Ontario)

• Vendor terms: contract clauses on training, retention, location and subcontractors (IPC ss. 5.3, 5.4)

• Clinician review: one note showing AI-drafted text, edits and sign-off (IPC s. 6.1)

• Disclosure: a list of states where you treat patients or sell, with the notice used (Cal. AB 3030; Tex. § 552.051; La. Act 649)

• Monitoring: the last accuracy sample, the last vendor update review, and a dated pause test (IPC ss. 6.7, 6.8)

Frequently asked questions

Is the IPC guidance mandatory?

The guidance itself is not law, and it states that it does not bind the IPC’s tribunal. PHIPA is law, and the guidance explains how the IPC applies PHIPA’s duties on consent, accuracy, safeguards, agents and breach notice to AI scribes. Treat it as the clearest public statement of what the regulator will look for.

Our scribe vendor is on a provincial vendor of record list. Is that enough?

It helps with vendor vetting. The IPC says no Ontario law requires buying from such a list, and that every custodian still has to do its own due diligence under PHIPA, including the contract terms in element 3.

We are a 60-person clinic group. Do we need an AI governance committee?

The IPC says a custodian too small for a committee should find a scaled-down way to cover the same functions, such as a designated person. What matters is that one person is clearly accountable for approving, monitoring and pausing the scribe.

We are only running a free trial. Does any of this apply yet?

Yes. The IPC says PHIPA obligations apply whether the service is paid or free, including giving patients access to and correction of their records after the trial ends.

This guide summarizes public guidance and law as of October 23, 2026. It is general information, not legal advice.