Governed AI for clinics and health providers.
Adopt AI scribes, intake, and triage tools without putting patient personal health information, or your standing as a custodian, at risk.
- Coverage
- PHIPA · Law 25 · PIPEDA
- Focus
- Patient confidentiality
- Delivery
- Bilingual, senior led
The problem
Clinics are adopting AI faster than the guardrails. Ambient scribes, intake chat, triage assistants, and transcription tools all touch personal health information. As a health information custodian you remain accountable for where that data goes, even when a vendor processes it. Many of these tools default to storage outside Canada and to retention settings no clinic would choose deliberately.
What we do
- Inventory every AI tool and embedded AI feature in the clinic, including tools staff adopted on their own
- Map where personal health information is processed and stored, and flag cross border exposure
- Score your obligations under PHIPA, Law 25, provincial health acts, and PIPEDA
- Set consent, retention, logging, and human review controls for each tool
- Draft the AI acceptable use policy and train clinical and admin staff
Your sensitive data stays yours
For clinics, the risk is not only compliance on paper, it is confidentiality in practice. We build AI adoption so patient personal health information never trains a public model. Every automation carries a mandatory human checkpoint. Clinical output is verified against the source, not taken on trust. We work from encrypted, secured devices, carry cyber liability coverage, and can sign a mutual confidentiality agreement before any engagement begins.
Clinic automation, the Build step
Once the governance is set, automation is where clinics get their time back: patient intake, scheduling and reminders, a secured messaging portal, billing and accounting handoffs, and end to end workflows across the clinic, each with compliance controls and a human checkpoint built in.
Our dental clinic work is a worked example of this step. See the clinic automation build.
Where we fit alongside your team
Clinical judgment and your obligations as a custodian stay with you. We own the security and governance program that supports them, and we hand over the operational proof: policies, records of review, vendor assessments, and training evidence.
Common questions
- Are AI scribes and intake tools allowed under PHIPA?
- They can be, but the health information custodian stays accountable. You need a written agreement with the vendor, clarity on where personal health information is stored and processed, retention and deletion controls, audit logging, and a documented human review of anything that goes into the record.
- Which rules apply to a clinic in Quebec versus Ontario?
- Ontario clinics fall under PHIPA. Quebec clinics fall under Law 25 and the provincial health information regime. Clinics in other provinces have their own health privacy acts, with PIPEDA as the baseline for commercial activity. We map your obligations to the province you actually operate in.
- Do you replace our IT provider?
- No. We build the governance and compliance program and hand your IT provider the specific configuration changes to make. We then verify they were made.
- Can you help with clinic automation as well as governance?
- Yes. Automation is the Build step: intake, scheduling, reminders, messaging, and back office workflows, each with the compliance controls and human checkpoints built in from the start.
Your next enterprise contract is waiting on this.
- Flat fee, total cost known up front
- Canadian data residency available on paid engagements