Sample privacy impact assessment: a clinic adopts an AI scribe

The physicians at Example Clinic wish to adopt an artificial intelligence scribe for use during consultations. The tool listens to the consultation, transcribes it and proposes a clinical note. The physician then reviews, corrects and files the note in the electronic medical record. The scribe is a cloud service provided by an American vendor. Example Clinic is undertaking the project for two reasons: to produce the clinical note for each consultation, and to reduce the time physicians spend on data entry. The information is not intended to be used for any other purpose.

This assessment covers the personal information the scribe handles. For patients, this means the audio recording of the consultation, the transcript and the clinical note, all of which are health information. For staff, it means the name and identifier of the physicians who use the tool. The project could involve between 100 and 10,000 persons. The assessment follows the information from its collection during the consultation, through its processing by the scribe vendor, to its filing in the electronic medical record. It does not examine the general operation of the electronic medical record beyond receiving and keeping the note. The tool does not make decisions about patients: the physician reviews and approves every note before it is filed.

The information is collected from patients during the consultation, when the scribe records the conversation between the patient and the physician. At present, patients are not informed that the tool is being used. The audio recording is sent to the scribe vendor's cloud service, which processes it in the United States. The vendor transcribes it and drafts a proposed clinical note. The name and identifier of the physicians who use the tool are also part of the processing. No written agreement with the vendor has been signed yet. The vendor's documentation states that the audio recording is deleted after transcription, but no contract confirms this. How long the vendor keeps the transcript and the draft note remains to be confirmed.

The proposed note comes back to the physician, who reviews it, corrects it and files it in the electronic medical record. The record is provided by a publisher in Québec, and Example Clinic has a written agreement with that publisher. Within Example Clinic, access to the information is limited to the staff who need it. Whether access to the information is logged remains to be confirmed. No retention period has been defined yet for the information the project handles, and this remains to be confirmed.

The assessment identified five findings. There is no written agreement with the scribe vendor, which processes the information outside Québec. No retention period has been defined. Patients are not informed that the tool is used. The register of technological products has not been published. Whether access to the information is logged remains unknown. The main risk is that health information will be processed outside Québec without adequate protection, which was rated high in both severity and likelihood. The assessment also identified a risk of retention longer than necessary, rated high in severity and medium in likelihood. Finally, it identified a risk of unauthorised access, rated high in severity and low in likelihood.

Several points remain to be confirmed. These include the retention period for the information, whether access is logged, and whether the vendor actually deletes the audio recording, as its documentation states but no signed contract yet guarantees. Example Clinic adopts the six measures set out in this document to address these findings and risks.