How do I keep patient health information safe under PHIPA when using AI tools?
Dental records are health records. AI tools need the same care as your practice software.
- Can staff use ChatGPT with patient details?
- Which AI tools are safe for clinics?
- What does PHIPA require?
Treat any tool that touches patient information as part of your health record system. In Ontario, PHIPA governs personal health information; other provinces have their own laws. Use only approved tools with clear terms on storage, training and access, keep patient identifiers out of general AI tools, limit access by role and train staff. Write it down in a short AI policy.
Data rules
| Data | General AI tools? |
|---|---|
| Marketing content, generic FAQs | Yes |
| De-identified questions | With care |
| Names, contact details, appointments | Only approved tools |
| Medical history, charts, x-rays | Only approved, contracted health tools |
Vendor questions
- Where is data stored?
- Is it used to train models?
- Who can access it?
- How is it deleted?
- How are breaches reported?
How we look at it at ShoutEx
We design automations that keep health data inside approved systems and document the data flow.
- Patient details in personal AI accounts.
- No written policy.
- Vendors without health data terms.
- Shared logins.
- Approved tool list.
- Data rules by type.
- Role-based access.
- Yearly staff training.
What dentists and regulators say
Here is what regulators say.
PHIPA governs the collection, use and sharing of personal health information in Ontario's health sector.
Read the IPC page →The principles call for limiting personal information and openness when using generative AI.
Read the principles →Community summaries describe recurring themes in public threads, not individual posts. Vendor pages describe vendor claims, so test them on your own calls.
Read next
Go deeper in the ShoutEx guides, or check the sources behind this answer.
We'll design automations that keep health data safe.
Book a call →Follow-up questions
Is an AI note-taker allowed in the operatory?
Only with approved tools, patient consent and a clear retention policy.
Do we need patient consent for AI?
Be open about AI use. Ask your privacy officer about consent requirements.
What about other provinces?
Each has its own health privacy law. Check yours.