For Alberta Clinics, “Can It Use AI?” Is the Wrong First Question

There is a lot of enthusiasm right now around AI tools for health clinics, and most of it is well-founded. The efficiency gains are real, the administrative burden that AI can lift off clinical and front-desk staff is significant, and the technology is genuinely useful in a healthcare context when it is implemented thoughtfully.

The problem is the word “when.”

Most conversations about AI in healthcare start with the question: can this tool do the thing I need it to do? That is a reasonable question, and it deserves an answer. But for Alberta clinics specifically, it is the second question, not the first. The first question is whether the tool has been set up to handle health information the way Alberta law actually requires.

This post is not a legal guide, and nothing in it should be read as legal advice. But it is a practical framing of the questions that matter before any AI touches a workflow that involves patient information, because Alberta’s privacy regulator has been very specific about what responsible implementation looks like, and the clinics that skip this step are taking on risk they probably don’t fully appreciate.

What Alberta’s privacy regulator actually says

In September 2025, Alberta’s Office of the Information and Privacy Commissioner, the OIPC, issued formal guidance specifically for healthcare custodians using AI tools. The document is titled AI Scribe Privacy Impact Assessment Guidance, and while it focuses on AI scribe tools specifically, the framework it establishes is the right mental model for any AI system that touches health information in a clinical setting.

The core requirement is straightforward: under the Health Information Act, custodians are required to submit a Privacy Impact Assessment to the OIPC before implementing any AI tool that collects, uses, or discloses individually identifying health information. That is a legal obligation, not a suggestion, and it applies whether the tool is a transcription service, an intake platform, a scheduling system with patient data in it, or anything else that processes information about identifiable patients.

The OIPC also issued broader guidance on responsible AI governance in Alberta in July 2025, which made clear that the province is actively developing its position on AI and privacy, and that health information, given its sensitivity, sits at the top of that concern. Alberta is not waiting for federal direction on this. The OIPC is moving, and the expectations on healthcare custodians are already in place.

The four questions worth asking before any AI touches patient information

Here is a practical framework drawn from the OIPC guidance that any clinic owner or practice manager can use to evaluate an AI tool before committing to it.

Question 1: What information actually touches this system?

Not what the vendor says the system uses, but what actually flows through it. Where does the patient’s name go? Does the appointment reason get processed? Is any clinical context captured, even incidentally? The answer to this question determines whether the Health Information Act applies at all, and in most cases, for tools that handle anything beyond purely administrative scheduling with no patient identifiers, the answer is yes.

Question 2: Where does that information go and who can access it?

A vendor headquartered in the United States operating under HIPAA is not automatically compliant with Alberta’s Health Information Act. The OIPC guidance is explicit that health information disclosed to a vendor becomes personal information subject to privacy law, and that contracts with vendors must prohibit unauthorized uses including using health information to train AI models. That last point is worth reading twice, because many AI tools improve their models using the data that flows through them, and a standard terms-of-service agreement with a consumer-grade AI product is almost certainly not going to address this adequately.

Question 3: What is the human review process?

The OIPC’s guidance consistently emphasizes human supervision as a non-negotiable element of responsible AI implementation in healthcare. AI can assist, summarize, route, and remind. It cannot be the final word on anything that affects patient care, and the workflow needs to be designed so that a human being is reviewing outputs before they become part of a patient record or influence a clinical decision. Common sense and the regulatory framework are pointing in exactly the same direction here, and any implementation that doesn’t build human review in from the beginning is going to create problems.

Question 4: What happens when something is wrong?

AI systems make errors. They misidentify information, miss context, and occasionally produce outputs that are confidently incorrect. A well-designed implementation has a process for catching those errors and correcting them before they cause harm, rather than discovering them after the fact when the damage is already done. The question to ask before implementing any AI tool in a clinical workflow is: if this system gets something wrong, how will we know, how quickly, and what is the correction process?

Why this framing makes you a better client to work with

Here is something worth saying directly, because it matters for how clinic owners approach the vendor conversation.

An AI vendor who gets uncomfortable when you ask these four questions is telling you something important. The OIPC’s framework exists precisely because the technology market has moved faster than the regulatory guardrails in many places, and some vendors are selling into healthcare contexts without having done the work to understand what that actually requires. A vendor who can answer these questions clearly, in writing, with specific reference to Alberta’s Health Information Act and the OIPC’s guidance, is a vendor who has taken the compliance obligation seriously. That is the conversation worth having before you sign anything.

This is also the framing that separates a clinic that implements AI well from one that implements it quickly.

Speed matters in operational efficiency. It does not belong in the question of whether patient information is being handled appropriately.

The clinics that understand that distinction tend to end up in a much better position than the ones that find out later what they should have asked upfront.

What responsible implementation actually looks like

Getting this right is not as complicated as it might sound from the outside, but it does require treating the implementation as a project with defined steps rather than a software purchase with a credit card.

It starts with mapping the workflow: what information flows through the proposed system, where does it go, who has access, and what does the vendor contract actually say about data use and retention. It continues with a Privacy Impact Assessment, which the OIPC has guidance documents to help with, and which needs to be submitted before the tool goes live rather than after. It includes configuring the system with human review built into the process at the right checkpoints. And it includes a clear plan for what happens when something goes wrong, because something eventually will.

None of that is beyond the reach of a small clinic. It requires the right guidance and a structured approach rather than a quick demo and a subscription, but the output is an implementation that can actually be defended if it is ever questioned, and a tool that the whole team can use with confidence.

Before you bring AI into a health-service workflow, do you have answers to those four questions? If not, that is the right place to start, and it is exactly the kind of conversation worth having before anything else. Book a call and we’ll work through it together.