More than 12,000 primary care professionals across Canada have signed up for Canada Health Infoway's AI scribe program, launched in June 2025. The tool itself, the AI scribe, is a specialised AI agent: it listens to the appointment, produces a transcript and then a note, and the physician reviews it before signing. The pitch is simple: less time spent writing.
This piece is written for whoever signs the contract on the clinic's behalf and will one day have to explain where the recordings went. It doesn't judge the clinical quality of the notes. It covers what the Collège des médecins du Québec (CMQ, Quebec's college of physicians) asks for and what the law requires of the clinic, which is where the questions for the vendor come from.
The short answer, for the busy
In Quebec, the Collège des médecins sets two conditions before a physician uses an AI scribe, the software that listens to the appointment and drafts the note. First, a tool certified by Santé Québec's certification office; the public list on quebec.ca showed nine certified products on September 21, 2026. Second, the patient's explicit consent, obtained through a conversation about the tool's purpose, benefits, risks and limits. A poster in the waiting room is not enough. A private clinic covered by Quebec's Act respecting health and social services information must also carry out its own privacy impact assessment (PIA) before acquiring the tool, and make sure the information stays protected if it leaves Quebec. The audio recording and the verbatim transcript are to be destroyed as soon as the physician has reviewed and signed the note, which remains the physician's responsibility.
Three documents where there used to be one
According to the CMQ, an AI scribe listens to, and sometimes records, the conversation, transcribes it word for word, then generates a medical note. So every appointment now produces three things: the audio, the full transcript and the note. Only the note is meant for the patient's file. The CMQ treats the other two as a physician's scratch notes, a memory aid for writing the official note, and says plainly that they must be destroyed once the physician has reviewed and signed the note produced by the scribe (our translation; the CMQ publishes in French only). As long as they exist, it adds, the recording and transcript can be requested by the patient in an access request, and the physician will have to hand them over.
Audio raises its own issue. Santé Québec's FAQ on AI scribes (September 2025) points out that a voice is a unique identifier, protected like a person's image by Quebec's Charter of human rights and freedoms and the Civil Code. And the CMQ notes that a clinical conversation identifies the patient even if their name is never spoken. Removing a name doesn't make information anonymous, as our piece on anonymizing personal information explains.
Which law applies to your clinic
A clinic run as a "private health facility" (the business where physicians, dentists or other professionals practise privately on their own account, with no lodging and no specialised medical treatment) is listed in Schedule II of the Act respecting health and social services information, in force since July 1, 2024, along with specialised medical centres. That makes it a "body" under the Act. Santé Québec's FAQ explicitly puts private family medicine groups (GMFs) in that category. For this health information, Law 25 steps aside: section 3 of the private-sector act expressly excludes it. Law 25 still governs everything else, such as employee files. How the two split, and the grey areas, are covered in our piece on Quebec's health information act for private clinics.
If your business falls outside every category in the schedule, the conversation is still sensitive personal information under Law 25, which names medical information as its first example (s. 12). The same reflexes then apply through other sections: a PIA for any project to acquire an information system (s. 3.3), and another before communicating information outside Quebec (s. 17).
What the CMQ asks of the physician
The CMQ's AI scribe page collects its guidance since January 2025. Four points bear directly on the purchase.
A certified tool. On January 14, 2026, the Collège wrote that it asks every physician using an AI scribe to choose a tool certified by Santé Québec's certification office. If yours isn't, the CMQ suggests asking the vendor whether it has started the process, and otherwise switching tools. Santé Québec's FAQ adds that private GMFs are subject to the certification requirement too.
A PIA for your own setting. Santé Québec has completed PIAs that are valid for its own institutions. The CMQ reminds physicians working outside those institutions, in a GMF for instance, that they must make sure a PIA was done for their workplace, because the technology environment may differ from theirs.
The note stays the physician's. It has to be reviewed and corrected before signing, and until it is signed, the CMQ says, it isn't considered official. The CMQ also recommends naming the scribe software in the note.
Caution about training. If the vendor trains its model on conversations, data may leave the country. When in doubt, the CMQ says, choose software whose training is finished.
Consent, and why the poster isn't enough
The quebec.ca page on AI transcription projects says the health ministry treats consent that is at least verbal as the baseline, and that patients can be informed with a visual aid on the desk. The CMQ is stricter, and its rule is the one that binds physicians: explicit consent is mandatory, and implicit consent based on, for example, information on a simple poster in the waiting room is deemed insufficient.
The CMQ spelled out the rhythm in June 2025. At first use, the physician explains what the vendor does with the information (recording, transmission, model training, server location) and says the scribe will also be used at later visits unless the patient objects. After that, a reminder is enough, for instance at the start of the recording: "Hello, just a reminder that you agreed to the use of an AI scribe…" (our translation). New consent is recommended if the visit covers a more sensitive topic than the first one, or if the tool changes in a major way, such as data now being used for training outside Canada.
Santé Québec adds two points. Its provincial committee prefers written consent, while recognising that verbal consent is valid if it's documented. And when the patient comes with a relative or an interpreter, everyone whose voice is recorded has to consent.
For the front desk, one thing matters: saying no changes nothing about care. Section 10 of the Act says a person's right to receive services can't be compromised by a decision not to consent to the use or communication of their information.
What to ask the vendor
Here's what the clinic should get in writing before signing, in the order in which the answers rule candidates out.
Is it on the list? The quebec.ca transcription page keeps a table of certified tools, updated September 21, 2026: nine certified products, four of them with a Santé Québec PIA. That PIA is valid only for Santé Québec, which says it can share it with partners such as the CMQ or the FMOQ (the family physicians' federation) to inform private clinics. Ask for it.
Where is the audio processed, and where is the note stored? Under section 5 of the Act, information whose storage is entrusted to a third party is still held by the clinic. If processing happens outside Quebec, section 78 requires a PIA before the contract, and the contract can only be signed if the assessment shows adequate protection. Our piece on AI agents hosted outside Quebec walks through that reasoning.
How long does it keep the audio and transcript? The CMQ says to check that the vendor doesn't keep them for an undue period. Santé Québec sets the benchmark: a 48-hour maximum is a mandatory requirement set by its provincial committee.
Does it train its models on your appointments? Get it in writing, either way. The answer changes what the physician has to explain to the patient.
What does the contract say? Section 77 of the Act requires a written contract that includes, on pain of nullity: a confidentiality undertaking from everyone who will access the information, prompt notice of any breach, the clinic's right to audit, and secure destruction at the end. A vendor that brings in a third party to do part of the work, a language-model or hosting provider for example, must notify the clinic. Ask who those third parties are.
One date to keep in mind: the free licences from Infoway's program expire no later than December 31, 2026, according to the same quebec.ca page. The page also keeps a second table, of the nine products selected for that program: six are not certified, and none of those six appears on the September 21 list. A licence obtained through the program is no guarantee of a certified tool. If your clinic uses one, the switch to a paid licence is the moment to ask these questions.
Do the PIA before you sign
Section 106 of the Act requires a PIA for any project to acquire a technological product that touches health information, proportionate to its sensitivity and volume. Recorded medical conversations sit at the top of that scale. The CMQ wants it done with the clinic's privacy officer, and section 107 adds that the clinic records every technological product it uses in a register published on its website.
Done before signing, the PIA helps you choose between two vendors. Done after, it documents a choice already made. Our guide to privacy impact assessments for private businesses describes what goes into one.
Where to start
A word of honesty, since we build custom AI agents: for the appointment note, buy a certified tool. A scribe built for your clinic wouldn't appear on any list, and the CMQ asks physicians to pick one that does.
Start with the quebec.ca list, then the five questions above, in writing. If you'd like an outside view on a contract or on what surrounds the appointment, get in touch.
This article explains legal and professional obligations to prepare a clinic's discussions with its vendors; it is not legal or ethics advice. The text of the Act respecting health and social services information, the Act respecting the protection of personal information in the private sector, and the publications of the Collège des médecins du Québec and Santé Québec prevail: for a specific situation, consult your professional order or a lawyer.
Written byXavier Peich