The guidance provides a framework for developing privacy impact assessments that will help custodians ensure they are compliant with the law.
The Office of the Information and Privacy Commissioner (OIPC) of Alberta has issued a guidance document that will assist custodians under the Health Information Act (HIA) in ensuring they are compliant with HIA when using AI scribe tools.
Artificial intelligence (AI) scribe tools transcribe and summarize interactions between people. In the case of custodians, such as physicians, the AI scribe tool would listen to and record conversations with patients, which would generally include sensitive information, and would then transcribe those conversations into a summarized text file, which is stored with the patients’ medical records. AI scribe tools have other capabilities as well, including generating prescriptions and referral letters, and integrating diagnostic images into records.
AI scribe tools are already being used by custodians in Alberta. While these tools may assist custodians in providing enhanced healthcare services, such as permitting a custodian to focus more on the patient rather than on taking notes during a patient encounter, there are privacy and security risks associated with the use of these tools that must be considered and addressed by custodians prior to using them.
Under HIA, custodians are required to submit to the OIPC privacy impact assessments (PIAs) that describe the effect of any proposed administrative practice or system or change in administrative practice or system involving the collection, use and disclosure of individually identifying health information. This means that custodians must submit a PIA on any implementation and use of AI scribe tools.
Because AI scribe tools are a new and emerging technology, the OIPC has developed guidance to help custodians develop the necessary privacy impact assessment(s) on the use of such tools, which, in turn, will help custodians ensure compliance with HIA.
The guidance for custodians can be found on the OIPC website here.
Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act. The Commissioner operates independently of government.
For more information:
Elaine Schiman
communications@oipc.ab.ca
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
Mobile: (587) 983-8766