The duty you carry
Under PHIPA and its provincial counterparts, custodians and their agents answer for every use and disclosure of personal health information, and a public AI tool is not a permitted destination. One pasted referral can carry a name, a health card number, and a diagnosis at once. And trust is the clinical currency: patients forgive slow software, not leaked charts.
The moment it breaks
Synthetic example. The real version happens on your busiest day.
The summary still gets drafted, with placeholders. The patient's identity and condition never leave the organization.
Caught, in your vocabulary
Health card and record numbers
The identifiers health-privacy law is written around, caught in prompts and file uploads alike.
Diagnoses and clinical notes
Conditions, results, and intake notes: personal health information even when the name is missing.
Patient names and contacts
The details that connect a clinical story to a person.
The rules you answer to
PHIPA & provincial health-privacy law
Custodians answer for their agents' handling of PHI. A control at the point of disclosure, with an event log, is what reasonable measures look like in a browser-first clinic.
PIPEDA & Quebec Law 25
Health data is sensitive personal information. Quebec's regime adds explicit control and incident-recording expectations, with penalties reaching C$25M or 4% of worldwide turnover.
HIPAA (for U.S. patients)
Business associates carry safeguard duties of their own, and catching PHI before submission is an answer auditors understand.
From our research
Keeping PHI Out of LLM Prompts Under PHIPA and Bill C-27
Clinicians and researchers paste patient details into AI tools to save time, but PHI submitted to a public model can't be recalled. Here's how to keep it from leaving in the first place.
Canada Just Told OpenAI Its Training Data Practices Broke Privacy Law. Here's What That Means for Every Organization Using AI.
Canada's privacy regulators found OpenAI's original ChatGPT training practices violated privacy laws. Learn why this finding matters for your organization and how to address the hidden risks of employee AI usage.
The Opt-Out Illusion: Why Turning Off AI Training Doesn't Make Your Data Safe
Turning off AI training doesn't mean your data is safe. Understand why 'don't train on our data' is a narrow promise, and why you need upstream controls to prevent data leaks.
Also built for
See it on your own scenarios
Twenty minutes, your examples, no slideware. Or start with the five-question readiness check. No email required.