Care teams use AI. PHI shouldn't.

Not with identifiable patient information unless the Act's conditions are met. Since July 1, 2024, the Act treats everything a covered clinic holds as confidential, and handing it to an outside provider generally requires a written agreement with prescribed clauses and, if the data leaves Quebec, a prior privacy impact assessment. A personal ChatGPT account meets neither condition, so clinics should provide approved tools and stop identifiable data at the prompt.

Only if your REB-approved protocol and the participants' consent allow it. TCPS 2 requires researchers to describe their data safeguards to the REB and to obtain approval before substantive changes, including changes to privacy and confidentiality measures, so running identifiable participant data through an unapproved AI tool may fall outside what was approved. Ask your REB before using the tool, not after.

Approval attaches to a tool, not to the patient data. An AI scribe chosen through Ontario's AI Scribe Program comes with vetting, contract terms and a privacy assessment; a personal ChatGPT account comes with none of those, so pasting identifiable patient notes into it can be an unauthorized disclosure under PHIPA. Close the gap by giving clinicians a sanctioned way to draft letters and summaries, and by catching identifiable data before it reaches unapproved tools.