Rules · Clinics · PHIPA and IPC Ontario
Can your clinic put patient information into ChatGPT?
Not into a consumer chatbot. AI can still take work off your desk, once it is set up for health information.
The rule
In Ontario, the Personal Health Information Protection Act (PHIPA) governs how health information custodians, including physicians, nurses and the clinics they run, collect, use and disclose personal health information. Custodians must take reasonable steps to protect it against theft, loss and unauthorized use or disclosure.
Pasting a patient’s details into a free, consumer AI chatbot sends that information to a company the clinic has no agreement with. Depending on the tool’s terms, it may be stored, reviewed or used to improve the service. For a custodian, that can be an unauthorized disclosure. PHIPA requires custodians to notify affected patients of a privacy breach and, in certain cases, to report it to the Information and Privacy Commissioner of Ontario.
That does not rule AI out. It rules out using it carelessly. A tool that handles health information has to be chosen and set up for it: a written agreement with the provider, clear limits on what the provider can do with the data, access controls, and a record of who used what.
The safest work for AI sits away from the chart. Answering general questions about hours and services. Reminders that carry no clinical details. First drafts of posts and pages, which a person then checks against CPSO and CNO rules. Where AI does touch patient information, it should be inside tools the clinic has assessed, and a person should check what it produces.
Write it down. A one-page policy that says which tools staff may use, for what, and with what information protects patients and the clinic, and it is the first thing a regulator will ask to see.
A plain-language read, not legal advice. Rules change, so check the source or ask us before you publish.