What are Canada's privacy regulators asking for on AI in health care?

On October 29, 2026, the federal privacy commissioner's office published a joint resolution from the country's federal, provincial and territorial privacy regulators on artificial intelligence in health care and health research. The commissioners and ombuds adopted it on September 15, 2026, at their annual meeting in Ottawa. In Québec, the Commission d'accès à l'information (CAI) released the same announcement in French the same day.

The message is simple to state: AI tools are spreading through clinics, hospitals and research labs faster than the rules that govern them, and the regulators want governments to close that gap with law, not only with guidance. This article is general information, not legal advice.

What the regulators adopted

The resolution starts from the pressure on health systems: rising costs, an aging population, long waits and a shortage of staff. It accepts that AI can help, and lists the kinds of systems it has in mind: diagnostic and classification tools, and generative AI such as chatbots and AI scribes, which listen to a medical appointment and draft the clinical note.

It then names the risks of waiting:

• Unauthorized use of health information. For example, an AI system can combine a de-identified dataset with other information and make people identifiable again, or be trained on data that was obtained illegally.
• Security. Large volumes of sensitive data without proper protection are a target for cyberattacks.
• Bias and patient harm. A model trained on data that underrepresents some groups can make less accurate predictions for them, which can mean wrong diagnoses or poor treatment plans.

Against those risks, the regulators set six principles that health AI should meet across its whole life, from design to retirement:

What they ask of governments, developers and clinics

To governments, the resolution makes four calls: review, amend or adopt laws so health AI meets the six principles; consult their privacy regulator while drafting them; involve the public, especially people from marginalized and vulnerable groups; and legally require everyone who develops, procures or uses health AI to have governance and accountability frameworks based on risk assessments. That last point is what makes this a call for binding rules: today, much of this is voluntary.

To developers and suppliers, it asks for privacy by design: use de-identified or synthetic data where possible, know where training data came from and that it was lawfully obtained, make the most protective settings the default, allow audits and real-world testing, avoid designs that push users into giving up privacy, and give clients a general explanation of how the system works.

To health providers that buy and use these tools, it asks them to:

• tell patients clearly how their information is used and, where practicable, offer a way to opt out before a system is deployed;
• name a contact person for questions or objections, and give a practical way to challenge consequential decisions;
• write contracts that forbid suppliers from using or selling the data for other purposes;
• train staff and prevent shadow AI, the use of personal AI tools that the organization has not approved, such as an employee pasting notes into a chatbot of their own;
• keep a human reviewing the outputs.

To researchers, it asks Canada's research ethics bodies to update the national ethics policy for research with people (TCPS 2) for AI, and to give research ethics boards the training and resources to assess AI projects.

What it means in Québec and across Canada

A resolution from regulators does not change any law. Health information in Canada is governed by a mix of federal, provincial and territorial statutes, and the regulators commit only to coordinate guidance, enforcement and public education "to the extent possible" within their own mandates.

In Québec, the CAI's version of the announcement adds a statement from its president, Lise Girard. She notes that Québec's law on health and social services information, adopted in 2023, already changed how that information circulates, is used and is protected, and that AI raises new questions governments will have to answer. She points to the CAI's 2026 five-year report, which calls for a new approach to protecting personal information in the digital age. For the general Québec privacy rules that apply to AI tools in businesses, see the guide's article on Law 25.

A worked example: a clinic considering an AI scribe

Suppose a family clinic wants to try an AI scribe. Using the resolution as a checklist, the clinic's questions to the supplier would look like this:

An assistant can help prepare that conversation, as long as you treat its output as a draft:

I work at a small health clinic in Canada that is considering an AI scribe. Draft a list of questions to send to the supplier, grouped under these headings: data location and retention, use of data for training, accuracy testing and audits, patient notice and opt-out, human review, and contract terms on reuse or sale of data. Do not give legal conclusions; mark any point where we should check our provincial health privacy law or ask our privacy regulator.

What can you do as a patient right now?

You can ask. If a clinic or hospital uses an AI scribe or another AI tool in your care, the resolution expects it to explain how your information is used, to name someone who can answer your questions, and, where practicable, to let you opt out before the tool is used. Asking "Is an AI tool recording or summarizing this appointment, and can I decline?" is reasonable.

Be careful with what you share with consumer AI tools yourself. The resolution is about organizations in the health system; it does not cover what you choose to paste into a general chatbot on your own. And if you believe your health information was misused, the privacy regulator for your province or territory (the CAI in Québec) can tell you what your options are.