The AI didn't break in. It was on the invite list.
A physician left an Ontario hospital in 2023 but stayed on a recurring rounds invite through a personal email address. A year later he installed an AI transcription tool. It found the meeting in his calendar, joined on its own, and emailed a summary of a discussion about seven patients to all 65 people on the invite. Twelve no longer worked there.
The Information and Privacy Commissioner of Ontario traced it to two ordinary gaps: a personal email where a work one belonged, and an invite nobody cleaned up.
Neither is an AI problem. Both are offboarding. What's new is software willing to act on the leftovers.
When someone leaves your organization, what still has their name on it?
What this means for health organizations
Recurring meetings, shared calendars and distribution lists are easy to miss when someone leaves, and AI note-takers will act on whatever access they find. Add them to your offboarding checklist.
It's also worth deciding whether AI transcription tools are allowed in meetings where client information is discussed. In this case, the IPC noted that the hospital shouldn't have relied only on the former physician to get the transcript deleted.
