Short answer. AI for health clinics is allowed in Alberta, on the Health Information Act’s terms. Physicians, pharmacists, dentists and other custodians must submit a privacy impact assessment to the Office of the Information and Privacy Commissioner before using an AI scribe or any AI system that handles identifying health information. The College of Physicians and Surgeons of Alberta also expects patient consent, documented AI use and physician review of every AI-written note. The safest first projects are documentation and admin work with a vendor contract that bans training on patient data.
Law and guidance verified 23 September 2026. Not legal advice.
AI for health clinics has already reached Alberta exam rooms, mostly as AI scribes. Hundreds of physicians on the provincial Connect Care system use an internally built scribe, and a national scribe program has handed out free one-year scribe licences to primary care clinicians since June 2025.
The paperwork has not kept pace with the software.
On 3 September 2025 Alberta’s privacy commissioner published guidance that settles one point with no wiggle room: custodians must submit a privacy impact assessment on any implementation and use of AI scribe tools. Any family practice in Lethbridge or anywhere else that signed up for a free scribe last winter, turned it on, and never filed anything with the commissioner is out of step with the Health Information Act. The licence being free changes nothing.
None of this makes AI for health clinics a bad idea. The documentation load on Alberta physicians is real, and the tools that cut it are good. It means the order of operations matters: contract, assessment, consent, then switch it on. This piece is the version of that order I would hand to a clinic owner, written for private practices rather than hospitals.
What does the Health Information Act require of AI for health clinics?
A custodian must submit a privacy impact assessment to the privacy commissioner before using any AI system that collects, uses or discloses identifying health information. The clinic also needs a compliant vendor agreement, reasonable safeguards, a breach process and, for recording tools, patient consent that holds up.
Custodians under the Health Information Act include physicians, registered nurses, pharmacists, optometrists, opticians, chiropractors, podiatrists, midwives, dentists, denturists and dental hygienists, as well as Alberta Health Services and Covenant Health. If your clinic is run by one of those professions, the Health Information Act is your privacy law. Where a service falls outside the Act’s definition of a health service, the College of Physiotherapists of Alberta notes, Alberta’s Personal Information Protection Act picks it up instead. Physiotherapy, psychology and other colleges publish their own guidance on which applies to their members, and that is the first thing to check.
The commissioner’s AI scribe PIA guidance walks through the sections that matter. In plain terms:
- Section 64. Submit the privacy impact assessment, meaning a written analysis of how a new system collects, uses and discloses health information and what could go wrong, before you implement.
- Section 60. Take reasonable administrative, technical and physical steps to protect the information.
- Section 66. Any vendor that stores or processes health information for you needs a written agreement containing what the Health Information Regulation requires.
- Section 23. Collecting health information with a recording device the patient can’t see requires the patient’s written consent, and the guidance flags that an AI scribe may trigger this.
- Section 60.1. Report a breach that creates a risk of harm as soon as practicable.
Two lines in that guidance deserve to be printed and taped to the monitor of whoever signs vendor contracts. The commissioner says the Act “would likely not permit” a vendor to use health information it receives from a custodian to train its AI. And the guidance says a custodian has no authority to give up control of health information except as the Act allows, which means the contract must return or destroy the data when it ends.
Vendor agreements that cite HIPAA or PIPEDA don’t help you. The guidance is blunt that Alberta’s Act governs health information in Alberta, whatever the vendor’s template says.
What does the CPSA say about AI scribes and consent?
The College of Physicians and Surgeons of Alberta says physicians stay fully accountable for every clinical decision and every entry in the record. Patients must be told about AI use and asked for consent, the use must be documented, and AI-generated notes must be reviewed before they enter the chart.
The college updated its Advice to the Profession on AI in clinical practice on 9 April 2026. It notes that AI is currently unregulated in Canada and Alberta, and it puts the weight on the physician instead. A July 2026 follow-up from the college on clinic readiness went further on consent: patients should understand the purpose, be able to ask questions and be able to decline. Clinics should record the patient’s choice and have a workflow ready for people who say no.
That last part is the easiest one to skip. If the scribe is how your physicians now finish notes on time, every patient who declines puts that typing back into someone’s evening. Plan for it before launch, not after the first refusal.
The Alberta College of Family Physicians published AI scribe guidelines in November 2025 that repeat the PIA requirement and add bias checks, audit trails and ongoing evaluation. Physicians working inside Alberta Health Services or Covenant Health sites also follow those organizations’ own AI policies.
Where AI for health clinics helps, and what each use triggers
Useful AI work in a clinic sits in documentation, the front desk and the back office. Each use touches different information and carries a different compliance load. Anything touching identifying health information needs the PIA and a vendor agreement; admin tools with no patient data carry far less.
| Use | Patient information involved | What it triggers | My view |
|---|---|---|---|
| AI scribe drafting visit notes | Full conversation audio and transcript | PIA, section 66 agreement, consent process, section 23 check, retention rules for audio | Best first project for physician clinics |
| Referral and consult letters drafted from the chart | Diagnoses, history, medications | PIA if the tool reads the chart, physician review of every letter | Good second project, often inside the scribe |
| Fax and referral inbox sorting | Incoming referrals and results | PIA, accuracy checks so nothing lands in the wrong patient file | High value, needs careful testing |
| Phone answering and booking | Names, reasons for visit, callback numbers | PIA if identifying health information is captured, clear hand-off to staff | Worth it for booking, keep clinical triage out |
| Patient-facing chatbot for health questions | Symptoms typed in by patients | PIA, CPSA accountability, real risk of advice nobody reviewed | Wait |
| Staff scheduling, policy lookups, internal email | None if set up properly | A clinic AI policy and approved tools | Do it now |
For most physician-led clinics, the AI scribe is the right first project, and a patient-facing chatbot is the wrong one. The scribe produces a draft a physician reviews before anything happens. The chatbot produces answers nobody reviews until a patient acts on them. Same technology family, completely different exposure.
The back-office row matters more than it looks. Staff at most clinics are already pasting things into free chatbots, and the fix is an approved tool and a one-page rule about what never goes in. The AI acceptable use policy template is built for exactly that, and finding the shadow AI already in use takes an afternoon.
What is Alberta already doing with AI scribes?
Alberta’s public system built its own tools. Health Shared Services reports hundreds of physicians using an internally built AI scribe since 2024, and a Red Deer emergency physician’s scribe, Jenkins, was piloted at three Alberta hospitals under a two-year evaluation. Community clinics mostly buy commercial products instead.
Dr. Mike Weldon, an emergency physician at Red Deer Regional Hospital Centre and a former electrical engineer, built Jenkins and refined it with Alberta Health Services and the University of Alberta. It was piloted in Red Deer and at the University of Alberta and Royal Alexandra hospitals in Edmonton, funded by a $1 million, two-year grant from the Canadian Medical Association, with the evaluation expected to wrap up by June 2026. Weldon told Canadian Healthcare Technology he sees three or four more patients per shift with it.
One physician’s estimate is not a study, and it came from the tool’s builder. Treat it as a reason to run your own pilot and measure, not as a number to put in a business case.
The public side also shows the governance shape worth copying. Health Shared Services requires training before anyone uses an AI tool and tells users they remain accountable for all aspects of patient care. A small clinic in Calgary doesn’t need a steering committee, but it does need the same two rules.
On the private side, Canada Health Infoway’s AI Scribe Program launched in June 2025 with fully funded one-year licences for primary care clinicians, and reports enrolling more than 12,000 across the country. One-year licences end. When they do, clinics pick a paid plan, switch or stop, and that decision is the right moment to do the vendor due diligence that the free sign-up may have skipped.
Don’t pick a scribe vendor based on the free year.
How should a clinic choose an AI scribe vendor in Alberta?
Choose on contract terms first and features second. The vendor must accept Alberta’s Health Information Act, refuse to train on your patients’ data, state where data is hosted and for how long audio is kept, support your PIA with its own documentation, and return or destroy everything when you leave.
If a vendor’s contract lets it train its model on your patients’ visits, that is the end of the conversation. Everything else on this list is negotiable in degree. That one isn’t, given what the commissioner has written.
The commissioner’s guidance lists what the vendor side of a PIA should cover, and it doubles as a buying checklist:
- Where the data is hosted, and which features you’ve switched off.
- How long the full audio recording is kept, why, and how it gets deleted.
- How the tool keeps one patient’s information out of the next patient’s note, including session controls.
- How notes reach the right patient in your EMR.
- What the tool does to limit invented content, the errors the industry calls hallucinations.
- Audit logs you can actually read, and a breach notice commitment back to you.
- Staff training on their duties under the Act.
Hosting location sits inside a bigger question about where your AI keeps your data, and the general version of this list lives in the questions to ask any AI vendor before you sign. For health, the Alberta Act turns several of those questions from good practice into requirements.
Paste this into your AI. Use it with a general assistant to prepare for a vendor call. Don’t include any patient information.
I run a [type of clinic] in Alberta with [number] clinicians. We are custodians under Alberta's Health Information Act and are evaluating [vendor name] as an AI scribe. Using the OIPC Alberta AI Scribe PIA guidance (September 2025) as the standard, write 15 specific questions for the vendor covering: data hosting location, audio retention and deletion, use of our data for model training, session controls between patients, EMR integration, error and hallucination controls, audit logs, breach notification to us, and return or destruction of data at contract end. For each question, say what a good answer looks like and what answer should end the evaluation.
What is changing in Alberta’s health privacy law?
Bill 11, the Health Statutes Amendment Act, 2025 (No. 2), tabled in November 2025, amends the Health Information Act to allow automated systems, including AI, in health service delivery. Alberta’s privacy commissioner has raised the concern that it gives patients no matching privacy rights over those systems.
The bill also creates shared custody of health information among several custodians. In her response to Bill 11, Commissioner Diane McLeod said that the shared model could create confusion across the system without clear accountability, and she recommended administrative monetary penalties that the bill doesn’t include. IAPP reported that the amendments, including a route for vendors to submit their own security documentation to the commissioner, took effect in June 2026.
For a clinic owner, the practical read is simple. The law is moving toward permitting more AI for health clinics, with the privacy obligations you already carry staying firmly in place. None of the changes removes the PIA, the vendor agreement or the physician’s accountability, and the same logic runs through AI governance for Canadian businesses generally.
If you do one thing this month, open your AI vendor contracts and read the data-use clause. If it permits training on patient information, or you can’t tell, fix that before you do anything else on this list.
Questions people ask
Yes, if you are a custodian under the Health Information Act. The Office of the Information and Privacy Commissioner of Alberta said in September 2025 guidance that custodians must submit a privacy impact assessment on any implementation and use of AI scribe tools. The assessment goes to the commissioner before the tool is used with patients.
The College of Physicians and Surgeons of Alberta expects physicians to inform patients and obtain consent before using AI in their care, and to document it. Patients should be able to decline. Separately, section 23 of the Health Information Act requires written consent where a recording device the patient can’t see is used, which may apply to some scribe set-ups.
Alberta’s privacy commissioner says the Health Information Act would likely not permit a vendor to use health information received from a custodian to train its AI. Clinics should read the data-use clause in every AI contract and refuse terms that allow training on patient information.
The physician. The College of Physicians and Surgeons of Alberta says regulated members remain fully accountable for all patient record content and clinical decisions, including outcomes influenced by AI. Every AI-generated note should be reviewed for accuracy, completeness and invented content before it becomes part of the record.
It depends on the profession and the service. The Act names custodians including physicians, nurses, pharmacists, dentists, optometrists and chiropractors. Where a service falls outside the Act’s definition of a health service, Alberta’s Personal Information Protection Act applies instead. Check your college’s privacy guidance before choosing tools.
Staff scheduling, internal policy lookups, drafting general clinic communications and summarizing non-patient documents can all run on approved business AI tools with no identifying health information involved. A short written rule about what may never be entered into those tools keeps them on the right side of the Act.
