Is AI Referral Management PHIPA and PIPA Compliant? A Guide for Canadian Clinics
Quick answer
AI referral management can comply with Ontario’s PHIPA and British Columbia’s PIPA when the vendor works on the clinic’s behalf under a written agreement, protects personal health information with strong security controls, limits access, logs activity, supports retention and breach-response obligations, and keeps data in Canada. The clinic remains accountable, so these terms need to be in writing.
Which privacy laws apply to specialty clinics in Ontario and BC?
Ontario: PHIPA. The Personal Health Information Protection Act governs how health information custodians, including physicians and clinics, collect, use and disclose personal health information. The federal Office of the Privacy Commissioner treats PHIPA as substantially similar to PIPEDA for health information.
British Columbia: PIPA. The Personal Information Protection Act applies to private organizations in BC, including physician practices. It has been declared substantially similar to PIPEDA.
BC public bodies: FIPPA. Hospitals, health authorities and the Ministry of Health are governed by the Freedom of Information and Protection of Privacy Act instead of PIPA.
Federal: PIPEDA. PIPEDA still applies to personal information that crosses provincial or national borders and to commercial activity not covered by a substantially similar provincial law.
Who is responsible when a vendor handles patient data?
In Ontario
Under PHIPA, the clinic or physician is the health information custodian. A vendor typically acts as an agent, an electronic service provider, or both. The Information and Privacy Commissioner of Ontario’s guidance is clear that custodians remain responsible for personal health information handled by their agents. If an electronic service provider is not an agent, Ontario’s regulations restrict it from using the information except as needed to provide the service, and from disclosing it.
In British Columbia
Under PIPA, the clinic is responsible for personal information in its custody or control, including information handled by service providers. The BC Physician Privacy Toolkit, produced by the OIPC, Doctors of BC and the College of Physicians and Surgeons of BC, explains consent within the circle of care and the duty to use information only for the purpose it was collected. An OIPC compliance review of medical clinics emphasized written privacy policies and documented breach-response planning.
What should clinics ask an AI vendor?
Will you sign an agreement defining your role as our agent or service provider, and the limits on how you use our data?
Where is patient data stored and processed? Is it kept in Canada?
How is data encrypted in transit and at rest?
How is access controlled, and is every access logged and reviewable?
Do you use our patient data to train models for other customers?
How do you support our retention schedule and deletion requests?
How will you notify us of a privacy breach, and how quickly?
Can you support our privacy impact assessment with documentation?
Does patient data need to stay in Canada?
Requirements vary by organization type, sector and contract, and public bodies in BC have their own rules. In practice, many clinics, health authorities and procurement processes expect Canadian data residency because it simplifies privacy assessments and reduces cross-border questions. Choosing a vendor that keeps data in Canada removes a common source of risk and delay.
What about clinical safety?
Privacy is not the only question. Clinics should confirm that AI suggests rather than decides on clinical matters, that physicians review flagged referrals, that urgent patient calls are escalated to staff or directed to emergency care, and that every action can be reviewed afterwards.
Does replacing fax improve privacy?
Often, yes. Privacy regulators have urged health care to move away from fax, and the CMPA notes that faxes are vulnerable to misdirection. Structured intake that reduces re-faxing and manual handling can lower risk, provided the new system is itself secure.
Key takeaways
PHIPA applies to health information custodians in Ontario; PIPA applies to private clinics in BC; FIPPA covers BC public bodies; PIPEDA covers cross-border flows.
The clinic stays accountable, so get the vendor’s role, limits, security controls and breach process in writing.
Canadian data residency simplifies compliance and procurement.
Physicians should keep control of every clinical decision.
Frequently asked questions
Is an AI vendor a custodian under PHIPA?
Usually not. The clinic or physician remains the custodian, and the vendor acts on its behalf, typically as an agent or electronic service provider under an agreement.
Do we need a privacy impact assessment?
It is good practice and often required by policy or procurement. The OIPC in BC publishes guidance on privacy impact assessments for the private sector.
Can AI vendors use our data to train their models?
Only if you agree. Ask for a clear written answer and make sure your agreement reflects it.
Does implied consent cover referral processing?
Within the circle of care, consent for using information to provide care is generally implied, but disclosures outside it usually need express consent. Confirm specifics with your privacy officer.
This article is general information, not legal advice. Consult your privacy officer or legal counsel about your specific obligations.
How Ample helps
Ample is PHIPA and PIPA compliant, keeps patient data in Canada, encrypts it in transit and at rest, limits access by role, logs every action and signs agreements before any data flows. Physicians always make the final triage decision.
Ample is built in Canada for specialty clinics in British Columbia and Ontario. It is PHIPA and PIPA compliant, keeps patient data in Canada, and works with Accuro, OSCAR Pro, PS Suite, Med Access, Juno and virtually any other EMR. More than 100 specialty clinics use it today. Book a 30-minute walkthrough to see it on your own referrals.
