AI in Healthcare in Quebec - What to Check Before Using It

What privacy authorities are calling for

On September 15, 2026, Canadian privacy authorities adopted a resolution on the responsible use of artificial intelligence in health and health research. It addresses tools such as diagnostic systems, chatbots and AI scribes.

The resolution sets out six principles: privacy, validity and reliability, safety, human rights protection, transparency and accountability. It calls on healthcare providers to establish controls, train staff and maintain human oversight.

A situation to consider before a first trial

Imagine a clinic planning to test an AI transcription tool during a consultation. Before recording begins, management should be able to explain what will be captured, where the content will go and how the note will be checked. This fictional example illustrates the preparation involved.

In Quebec, the checks extend beyond Law 25

The applicable legal framework depends on the organization and the information being processed. The Act respecting health and social services information, enacted through Law 5, provides a specific framework for the bodies it covers. It has been in force since July 1, 2024. Other applicable laws and professional rules must also be considered.

An organization may need to distinguish its care records from its human resources records. In particular, the Act specifies that information collected for human resources management purposes does not become health and social services information within the meaning of that Act simply because it concerns staff of a body in the sector.

Recent MSSS guidance on AI transcription

On its page updated October 28, 2026, Quebec’s Ministère de la Santé et des Services sociaux (MSSS) states that AI transcription tools require product certification under the trousse globale de vérification (TGV) process and a privacy impact assessment (PIA) by the acquiring organization, taking its context into account.

A PIA completed for Santé Québec applies to Santé Québec. Other healthcare organizations must conduct their own PIA. Product certification therefore does not replace this assessment.

The MSSS also reminds professionals that they remain responsible for content added to the record and must validate generated text. Requirements set by their professional order must also be checked.

A PIA must take place at the right time

In the private sector, a project to acquire, develop or overhaul an information system involving personal information requires a privacy impact assessment. The person responsible for personal information protection must be consulted from the outset. Disclosing personal information outside Quebec may also trigger a PIA requirement. These rules must be applied according to the legal framework governing the information involved.

The checks to complete before deployment

Before allowing a tool to process real records, your organization should be able to explain its intended use, how information flows and the conditions for approval. Exact HR proposes the following preparation process. These actions are operational recommendations to adapt to the project; they are not an exhaustive list of legal obligations.

1. Define a specific use and set its limits

Start with a concrete need, such as producing a first draft of a consultation note. Specify who will use the tool, in what setting and what information it may receive. Drafting assistance and clinical recommendations should be assessed separately.

• Describe the task, the expected benefit and how you will check that the tool meets the need. Avoid a broad objective such as “use more AI.”
• Identify excluded uses, such as diagnosis, treatment recommendations, automatic transmission of notes or using records to train a model. These limits must reflect the decision your organization actually makes.
• Appoint a project lead and involve the person responsible for personal information protection, security staff and the professionals concerned. Decide who can authorize the next stage.

2. Map the full flow of information

Follow information from capture through deletion. For an AI scribe, examine the recording, full transcript, summary and final note separately. Each may have different storage locations, access rights and retention rules.

• Identify what leaves the device or clinical record, which platform receives it and for what purpose. Include technical logs, temporary copies and backups.
• Ask where hosting and processing take place, who can access content for support or maintenance and which subcontractors are involved. Canadian hosting alone does not answer all these questions.
• Justify the information being transmitted. Check whether the objective can be achieved with less content and how copies that are no longer needed will be deleted, taking the rules governing the record into account.

3. Assess the vendor using evidence specific to the product

A sales presentation describing a product as “secure” or “compliant” does not explain how your subscription works. Request written answers covering the product, version, options and contractual terms you are actually considering.

• Data use: may the vendor or its subcontractors reuse recordings, prompts or outputs to improve or train their models? Can this be disabled, and is the commitment contractual?
• Access and security: what controls protect accounts and data? Ask about multifactor authentication options, permission management and available access logs.
• Contract termination and incidents: how will you retrieve the data? What happens to each copy after a deletion request? What commitments cover incident notification, assistance and changes to subcontractors?
• Documents: obtain the terms of service, data processing clauses and relevant security evidence. For healthcare transcription, also check the sector-specific requirements described above for the exact product selected.

4. Prepare an explanation people can understand

Staff should be able to explain plainly what the tool does and what happens to the information. First clarify the information and consent requirements under the applicable legal framework and professional rules. Avoid treating one standard statement as suitable for every tool and use.

• Prepare an explanation covering the tool’s function, the information involved, recipients and relevant retention arrangements. Identify whom people can contact with questions.
• Distinguish assistance with recordkeeping from possible reuse for research or model training. Have additional purposes assessed separately.
• Define how a refusal or withdrawal will be handled: who receives the request, how it is documented and what alternative can be offered. Check what consequences the applicable legal framework permits before responding.

5. Organize testing, human validation and ongoing monitoring

Before deployment, define what will justify accepting the tool and what will trigger a pause in its use. Begin preparatory tests with entirely fictional scenarios. Moving to real records should follow verification of applicable requirements and a documented decision.

• Test representative situations: specialized terminology, accents, negations, changes of speaker and contradictory information. Look for omissions, invented content and attribution errors.
• Assign someone to review and correct each note before it is added to the record. Avoid automatic transmission that would bypass this validation.
• Train users on authorized uses, permitted information and reporting errors or incidents. Provide instructions for questionable outputs and situations where an unapproved tool is proposed.
• Set criteria for suspending use, such as repeated significant errors, unexplained access, an incident or a major change to the vendor’s terms. Decide who can stop use and how work will continue during the interruption.

Before authorizing deployment

Management should have documentation that answers these questions: Is the use defined? Is the flow of data understood? Have the applicable checks and PIA been completed? Are the vendor’s terms acceptable? Are the explanations for individuals and note validation process ready? If a critical question remains unanswered, postpone the use of real records for that purpose and identify what must be resolved.